last executing test programs: 3.037775269s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x0, 0x0, 0x40, "0100"/64}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/lirc0\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)="0100000002000000", 0x8) 1.800828267s ago: executing program 1 (id=2): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0422c200000000000109022d0001010000000904000002030000000921110100012223000905810340000a00000905020340000a0000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022230000000600ff0900a10185020901150026ff0075089508810209029512910209039503b102c0"], &(0x7f0000000080)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x23}}}}, &(0x7f0000000200)={0x2c, &(0x7f0000000600)={0x40, 0x2}, &(0x7f0000000280)={0x0, 0xa, 0x1}, &(0x7f00000002a0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000240)={0x20, 0x1, 0x4, "02000000"}, &(0x7f00000002c0)={0x20, 0x3, 0x1, 0x1}}) syz_open_dev$hidraw(&(0x7f0000000500), 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000") syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000") syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000") syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000") syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000") 1.598754181s ago: executing program 4 (id=5): r0 = memfd_create(&(0x7f0000000000)='file0\x00', 0x0) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = memfd_create(&(0x7f0000000000)='file1\x00', 0x0) ftruncate(r2, 0x1000000) r3 = syz_open_dev$loop(&(0x7f0000000100), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = memfd_create(0x0, 0x0) ftruncate(r4, 0x1000000) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2) ioctl$LOOP_SET_FD(r5, 0x4c00, r4) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x81ff, 0x900000) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x2, 0x0) ioctl(r6, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000500000000100000030000000300000000000000010000000000000000000000000000000000000000000000000000000000000000100000") ioctl(r6, 0x40140921, &(0x7f0000000400)="0000000007000000000000000000000006000000") ioctl(r6, 0x40140921, &(0x7f0000000420)="0100000007000000010000000100000006000000") ioctl(r6, 0x40140921, &(0x7f0000000440)="0200000007000000020000000200000006000000") ioctl(r6, 0x400c0930, &(0x7f0000000500)='\x00'/12) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000820)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/chunk_size\x00', 0x2, 0x0) write(r7, &(0x7f0000000700)='8192\x00', 0x5) 1.229851205s ago: executing program 4 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/level\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='raid1\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='1:0\x00', 0x3) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/component_size\x00', 0x2, 0x0) write(r3, &(0x7f0000000a00)='4096\x00', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r4, &(0x7f0000000c00)='run\x00', 0x3) openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/serialize_policy\x00', 0x2, 0x0) 1.012305677s ago: executing program 4 (id=8): r0 = syz_mount_image$ext4(&(0x7f00000007c0)='ext4\x00', &(0x7f0000000800)='./file0\x00', 0x0, &(0x7f0000000840), 0x1, 0x782, &(0x7f0000000880)="$eJzs3FGIVNUfB/Dfvbvrf//u5LgZCGEkaCVE4+omGURsEMj6FAgRKOSWs7rt6NrORu3mgxZIvUQIZiCJvkTQi/QSvUkPoSSED/USGUVFBVZYD9HLxszsrMs6Y4O769X184G7c86Zvfd7zszlcA/MvQHctlZX/iQRuYjYGRH5qfY0IpZUS50RB2v/d6T39J7KlsTk5Lbfk8pucaD39J76sZKp166o7hKbI+LTviTWLLk6tzw+MTxQKhVHp+rrx/buX18en3hoaO/A7uLu4r5HHt60qbe3p2fz/I31nZU7Vnz5eP+moys/X7X6n2+OJ9FXHXfMGsd8Spo09i9EWIZmjjNpz7AjtGxZ53MLcs4DADe3ynV+W0S0V6/389EWtYu3j1/bcTkfjzW9TL3zyRO/3Mh+AgAAANdvsm0SAAAAWPSSyLoHAAAAwMKq/w7gQO/pPfXtRv324J7tEZeeiIjltfz6/cW1d9ur9xBHdEZHRCz9M4mZt5Umtd3mlv/sHA8wR+Wt2eZfeDrb/O4Ps80/+XXEwUMRcaavwfmfTJ1/169nVn32veD3rZhjwBz98H22+WvvzTb/6EjEmcr809do/kun559oMP+015+dMAevdl+Z/45cNf9dyW9rMv/1tZjz1vvn3mvUfvaLiEuHIu5ub5SfTOcnTfKfajG/u23tukbtz3wQMXkq4v5onD8zq/nzIdYPDpWKPbW/jfM/++7NYqP2/o7a+Jc2y0/imp//zhbH3/XThfP7G7RP9tfy16259vff6PNvm3rGRitOjX872qi98EItf1eT8f/X9/92i/lfbX/0bKP2Yx+1eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABuO2lE5CJJC9PlNC0UIroi4q5YmpZGymMPDo68tG9X5b2I5dGRDg6Vij0Rka/Vk0p9Q7V8pb5xVr03Iroj4o38/6v1wvMjpV1ZDx4AAAAWuVzExe2vf7Iy634AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBr6IqIXCRpISLSiPg5n6aFQta9AgAAAOZDLuLiqpMnjlfKf+Wz7g0AAACwECrr/8uHfzsX1v8AAACwaFn/AwAAwOI3c/0PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwM8hVtyQtRERaLadpoRBxR0Qsj45kcKhU7ImIZRFxPt/xv0p9Q9adBgAAAFqSi7i4pXPLj1n3AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAW0N5fGJ4oFQqjiooKChMF7KemQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyEJ5fGJ4oFQqjpaz7gkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZSn9NIqKyPZBfm3vx0uGtM99dkvydr75GxMvHtx17ZWBsbHRDpf2P6faxd6faN2Y1BgAAAGCm+jq9vo4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoVXl8YnigVCqOLmAh6zECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABw/f4NAAD//100t4w=") r1 = openat(r0, &(0x7f0000000400)='test\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000500)='hello\x00', 0x6) sync() 601.831416ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='0000:00:02.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='cirrus-qemu\x00', 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/drivers/cirrus-qemu/bind\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='0000:00:02.0\x00', 0xd) 388.998551ms ago: executing program 3 (id=4): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0xa, "11ff0000010000000000"}}, 0x10) 0s ago: executing program 0 (id=9): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a3000000000050004000000000005"], 0x60}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.62' (ED25519) to the list of known hosts. [ 88.619757][ T5606] cgroup: Unknown subsys name 'net' [ 88.738915][ T5606] cgroup: Unknown subsys name 'cpuset' [ 88.748819][ T5606] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 90.431502][ T5606] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.239163][ T30] cfg80211: failed to load regulatory.db [ 93.092350][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.103359][ T5626] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 93.112927][ T5626] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 93.125086][ T5626] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.132795][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 93.141595][ T5626] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 93.144498][ T5630] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 93.158318][ T5630] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 93.158554][ T5633] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 93.167308][ T5630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.173785][ T5633] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 93.181833][ T5630] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 93.201246][ T5630] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 93.201402][ T5633] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 93.209170][ T5630] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 93.218169][ T5633] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 93.224078][ T5630] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 93.233284][ T5633] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.245796][ T5630] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 93.247904][ T5633] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.253037][ T5630] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 93.262755][ T5633] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 93.268269][ T5630] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 93.275166][ T5633] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 93.287912][ T5630] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 93.298245][ T5630] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 93.310340][ T5622] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 93.335432][ T5622] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 93.345412][ T5622] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 93.355165][ T5622] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 95.314411][ T5635] Bluetooth: hci0: command tx timeout [ 95.320541][ T5622] Bluetooth: hci4: command tx timeout [ 95.394071][ T5635] Bluetooth: hci5: command tx timeout [ 95.394090][ T5630] Bluetooth: hci3: command tx timeout [ 95.394223][ T5630] Bluetooth: hci1: command tx timeout [ 95.400218][ T5622] Bluetooth: hci2: command tx timeout [ 95.880080][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.888710][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.897217][ T5623] bridge_slave_0: entered allmulticast mode [ 95.905070][ T5623] bridge_slave_0: entered promiscuous mode [ 95.969768][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.977032][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.984290][ T5623] bridge_slave_1: entered allmulticast mode [ 95.991920][ T5623] bridge_slave_1: entered promiscuous mode [ 96.057221][ T5632] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.064617][ T5632] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.072667][ T5632] bridge_slave_0: entered allmulticast mode [ 96.083166][ T5632] bridge_slave_0: entered promiscuous mode [ 96.093009][ T5632] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.100183][ T5632] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.107511][ T5632] bridge_slave_1: entered allmulticast mode [ 96.115354][ T5632] bridge_slave_1: entered promiscuous mode [ 96.251839][ T5632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.265406][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.274897][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.282132][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.289673][ T5619] bridge_slave_0: entered allmulticast mode [ 96.297570][ T5619] bridge_slave_0: entered promiscuous mode [ 96.358872][ T5632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.383998][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.393515][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.400726][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.407999][ T5619] bridge_slave_1: entered allmulticast mode [ 96.415812][ T5619] bridge_slave_1: entered promiscuous mode [ 96.450363][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.457784][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.465697][ T5621] bridge_slave_0: entered allmulticast mode [ 96.473574][ T5621] bridge_slave_0: entered promiscuous mode [ 96.536511][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.543802][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.551149][ T5621] bridge_slave_1: entered allmulticast mode [ 96.559294][ T5621] bridge_slave_1: entered promiscuous mode [ 96.569825][ T5632] team0: Port device team_slave_0 added [ 96.643195][ T5632] team0: Port device team_slave_1 added [ 96.651255][ T5623] team0: Port device team_slave_0 added [ 96.660823][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.735341][ T5623] team0: Port device team_slave_1 added [ 96.743774][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.783845][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.832305][ T5631] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.840332][ T5631] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.848645][ T5631] bridge_slave_0: entered allmulticast mode [ 96.856846][ T5631] bridge_slave_0: entered promiscuous mode [ 96.865412][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.872546][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.880249][ T5620] bridge_slave_0: entered allmulticast mode [ 96.888018][ T5620] bridge_slave_0: entered promiscuous mode [ 96.899251][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.909451][ T5632] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.916990][ T5632] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.943465][ T5632] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.982402][ T5631] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.989692][ T5631] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.997340][ T5631] bridge_slave_1: entered allmulticast mode [ 97.005234][ T5631] bridge_slave_1: entered promiscuous mode [ 97.012714][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.020124][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.027597][ T5620] bridge_slave_1: entered allmulticast mode [ 97.035562][ T5620] bridge_slave_1: entered promiscuous mode [ 97.055453][ T5632] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.062472][ T5632] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.088863][ T5632] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.100962][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.108056][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.133988][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.148811][ T5619] team0: Port device team_slave_0 added [ 97.203375][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.210445][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.236877][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.252428][ T5619] team0: Port device team_slave_1 added [ 97.286680][ T5621] team0: Port device team_slave_0 added [ 97.295927][ T5621] team0: Port device team_slave_1 added [ 97.328832][ T5631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.341644][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.355231][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.393269][ T5622] Bluetooth: hci4: command tx timeout [ 97.393334][ T5635] Bluetooth: hci0: command tx timeout [ 97.425120][ T5631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.472945][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.480039][ T5635] Bluetooth: hci2: command tx timeout [ 97.480081][ T5635] Bluetooth: hci3: command tx timeout [ 97.483422][ T5622] Bluetooth: hci5: command tx timeout [ 97.485627][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.490914][ T5635] Bluetooth: hci1: command tx timeout [ 97.496269][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.498484][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.545190][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.571250][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.638105][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.645353][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.671330][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.683714][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.690753][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.716902][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.748740][ T5632] hsr_slave_0: entered promiscuous mode [ 97.756177][ T5632] hsr_slave_1: entered promiscuous mode [ 97.765495][ T5620] team0: Port device team_slave_0 added [ 97.774727][ T5620] team0: Port device team_slave_1 added [ 97.787017][ T5623] hsr_slave_0: entered promiscuous mode [ 97.794482][ T5623] hsr_slave_1: entered promiscuous mode [ 97.801456][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 97.808533][ T5623] Cannot create hsr debugfs directory [ 97.840080][ T5631] team0: Port device team_slave_0 added [ 97.849327][ T5631] team0: Port device team_slave_1 added [ 98.031174][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.038710][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.065939][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.078495][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.085550][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.111502][ T5631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.156547][ T5619] hsr_slave_0: entered promiscuous mode [ 98.163023][ T5619] hsr_slave_1: entered promiscuous mode [ 98.169512][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 98.175324][ T5619] Cannot create hsr debugfs directory [ 98.184068][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.190998][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.217416][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.229972][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.237358][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.263455][ T5631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.296248][ T5621] hsr_slave_0: entered promiscuous mode [ 98.302765][ T5621] hsr_slave_1: entered promiscuous mode [ 98.309233][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 98.315031][ T5621] Cannot create hsr debugfs directory [ 98.609681][ T5620] hsr_slave_0: entered promiscuous mode [ 98.616264][ T5620] hsr_slave_1: entered promiscuous mode [ 98.622477][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 98.628585][ T5620] Cannot create hsr debugfs directory [ 98.659034][ T5631] hsr_slave_0: entered promiscuous mode [ 98.665908][ T5631] hsr_slave_1: entered promiscuous mode [ 98.672310][ T5631] debugfs: 'hsr0' already exists in 'hsr' [ 98.678541][ T5631] Cannot create hsr debugfs directory [ 99.065296][ T5632] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 99.081087][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.119456][ T5632] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 99.131267][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.140140][ T5632] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 99.150323][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.192777][ T5632] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 99.205645][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.346564][ T5623] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 99.357827][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.369578][ T5623] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 99.382052][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.390242][ T5623] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 99.401089][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.409759][ T5623] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 99.420045][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.473515][ T5622] Bluetooth: hci4: command tx timeout [ 99.483547][ T5622] Bluetooth: hci0: command tx timeout [ 99.526791][ T5619] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 99.538327][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.553648][ T5622] Bluetooth: hci5: command tx timeout [ 99.559306][ T5635] Bluetooth: hci1: command tx timeout [ 99.559389][ T5633] Bluetooth: hci2: command tx timeout [ 99.569941][ T5619] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 99.570292][ T5630] Bluetooth: hci3: command tx timeout [ 99.588333][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.612984][ T5619] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 99.625498][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.635301][ T5619] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 99.648426][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.764779][ T5621] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.786991][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.797025][ T5621] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.807882][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.833478][ T5621] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.846597][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.864125][ T5621] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.876006][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.887736][ T5632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.984491][ T5632] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.021316][ T1012] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.028935][ T1012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.042709][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.052990][ T5620] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 100.064728][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.073018][ T5620] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 100.087048][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.110642][ T5620] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 100.121829][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.156907][ T5620] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 100.168441][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.181884][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.189069][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.211521][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.258656][ T1012] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.265872][ T1012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.348980][ T509] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.356200][ T509] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.379384][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.388161][ T5631] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 100.400012][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.409119][ T5631] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 100.420156][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.443586][ T5631] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 100.454058][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.475939][ T5631] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 100.486636][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.577203][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.651893][ T1028] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.659134][ T1028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.710649][ T1028] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.717831][ T1028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.821344][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.997349][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.018921][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.066855][ T509] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.074067][ T509] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.144023][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.151239][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.209757][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.283292][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.290575][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.388930][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.396167][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.440130][ T5631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.558359][ T5630] Bluetooth: hci0: command tx timeout [ 101.558381][ T5633] Bluetooth: hci4: command tx timeout [ 101.634522][ T5633] Bluetooth: hci3: command tx timeout [ 101.634588][ T5630] Bluetooth: hci2: command tx timeout [ 101.639993][ T5635] Bluetooth: hci1: command tx timeout [ 101.650840][ T5630] Bluetooth: hci5: command tx timeout [ 101.660834][ T5631] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.743788][ T1012] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.751073][ T1012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.816201][ T5632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.886644][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.893934][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.958351][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.188546][ T5632] veth0_vlan: entered promiscuous mode [ 102.272154][ T5632] veth1_vlan: entered promiscuous mode [ 102.470326][ T5632] veth0_macvtap: entered promiscuous mode [ 102.508491][ T5632] veth1_macvtap: entered promiscuous mode [ 102.606969][ T5632] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.657116][ T5632] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.813759][ T1028] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.856314][ T1028] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.975551][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.074235][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.160414][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.201852][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.355158][ T5808] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.370083][ T5808] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.394618][ T1012] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.411366][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.511629][ T5623] veth0_vlan: entered promiscuous mode [ 103.530351][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.564923][ T5619] veth0_vlan: entered promiscuous mode [ 103.576958][ T5632] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 103.600800][ T5619] veth1_vlan: entered promiscuous mode [ 103.655543][ T5623] veth1_vlan: entered promiscuous mode [ 103.835462][ T5621] veth0_vlan: entered promiscuous mode [ 103.889443][ T5631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.919510][ T5619] veth0_macvtap: entered promiscuous mode [ 103.950337][ T5619] veth1_macvtap: entered promiscuous mode [ 103.976122][ T5621] veth1_vlan: entered promiscuous mode [ 104.006130][ T5623] veth0_macvtap: entered promiscuous mode [ 104.056997][ T5623] veth1_macvtap: entered promiscuous mode [ 104.098231][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.140202][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.192873][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.204362][ T186] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 104.204721][ T5631] veth0_vlan: entered promiscuous mode [ 104.237516][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.255119][ T37] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.283910][ T5631] veth1_vlan: entered promiscuous mode [ 104.319158][ T5621] veth0_macvtap: entered promiscuous mode [ 104.363663][ T1012] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.390610][ T186] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 104.402038][ T5621] veth1_macvtap: entered promiscuous mode [ 104.415069][ T186] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 104.439587][ T186] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 104.460557][ T186] usb 3-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 104.471414][ T186] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.479579][ T186] usb 3-1: Product: syz [ 104.484504][ T186] usb 3-1: Manufacturer: syz [ 104.495414][ T5620] veth0_vlan: entered promiscuous mode [ 104.497480][ T186] usb 3-1: SerialNumber: syz [ 104.528457][ T5853] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.536487][ T5853] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.554648][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.568198][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.573014][ T5853] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.578846][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.638617][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.665285][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.676964][ T5631] veth0_macvtap: entered promiscuous mode [ 104.691241][ T5620] veth1_vlan: entered promiscuous mode [ 104.742952][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.753977][ T5631] veth1_macvtap: entered promiscuous mode [ 104.776623][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.786218][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.808187][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.818201][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.836596][ T1012] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.876982][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.916500][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.933805][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.945738][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.054066][ T79] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.104622][ T5808] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.135038][ T5620] veth0_macvtap: entered promiscuous mode [ 105.208763][ T5620] veth1_macvtap: entered promiscuous mode [ 105.243913][ T5808] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.325600][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.350513][ T5863] loop0: detected capacity change from 0 to 32768 [ 105.353540][ T5766] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 105.359430][ T37] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.367675][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.378264][ T5863] loop1: detected capacity change from 0 to 32768 [ 105.410655][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.443395][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.536696][ T5766] usb 2-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 105.564167][ T79] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.575202][ T5766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.639109][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.687588][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.726624][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.824656][ T186] redrat3 3-1:1.0: Firmware rev: [ 105.859323][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.879371][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.949121][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.973878][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.996693][ T5869] loop4: detected capacity change from 0 to 2048 [ 106.003524][ T509] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.027222][ T186] redrat3 3-1:1.0: Failed to read timeout from hardware [ 106.063442][ T37] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.139787][ T5869] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.158470][ T5869] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 106.184866][ T186] rc_core: IR keymap rc-hauppauge not found [ 106.212539][ T186] Registered IR keymap rc-empty [ 106.240528][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.289892][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.302710][ T186] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/rc/rc0 [ 106.378990][ T186] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/rc/rc0/input5 [ 106.507578][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.544691][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.563788][ T62] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.580077][ T62] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.670760][ T186] redrat3 3-1:1.0: redrat3_enable_detector: detector status: 0, should be 1 [ 106.682626][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.709452][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.723301][ T79] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.757892][ T79] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.773940][ T186] redrat3 3-1:1.0: probe with driver redrat3 failed with error -5 [ 106.791048][ T5764] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 106.863923][ T509] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.975863][ T4985] ================================================================== [ 106.983991][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 106.986250][ T5882] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9'. [ 106.990961][ T4985] Read of size 1 at addr ffff8880264bb758 by task udevd/4985 [ 106.990994][ T4985] [ 106.991011][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 106.991052][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 106.991075][ T4985] Call Trace: [ 106.991087][ T4985] [ 106.991101][ T4985] dump_stack_lvl+0x100/0x190 [ 106.991145][ T4985] print_report+0x13d/0x4b0 [ 106.991199][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 106.991245][ T4985] ? __virt_addr_valid+0x239/0x430 [ 106.991291][ T4985] ? string+0x471/0x4d0 [ 106.991332][ T4985] kasan_report+0xdf/0x1c0 [ 106.991372][ T4985] ? string+0x471/0x4d0 [ 106.991418][ T4985] string+0x471/0x4d0 [ 106.991461][ T4985] ? __pfx_string+0x10/0x10 [ 106.991509][ T4985] vsnprintf+0x422/0x1300 [ 106.991567][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 106.991614][ T4985] ? ksys_read+0x12a/0x250 [ 106.991660][ T4985] ? do_syscall_64+0x115/0x870 [ 106.991709][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.991754][ T4985] add_uevent_var+0x183/0x3a0 [ 106.991794][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 106.991841][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 106.991879][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 106.991914][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 106.991951][ T4985] dev_uevent+0x2f1/0x870 [ 106.991989][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 106.992021][ T4985] ? kasan_save_track+0x14/0x30 [ 106.992082][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 106.992126][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 106.992183][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 106.992227][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 106.992279][ T4985] ? uevent_show+0x166/0x3a0 [ 106.992329][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 106.992374][ T4985] uevent_show+0x1ca/0x3a0 [ 106.992419][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 106.992465][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 106.992511][ T4985] dev_attr_show+0x52/0xa0 [ 106.992579][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 106.992637][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 106.992689][ T4985] seq_read_iter+0x32f/0x1270 [ 106.992750][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 106.992792][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 106.992835][ T4985] ? rw_verify_area+0xce/0x6d0 [ 106.992876][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 106.992919][ T4985] vfs_read+0x82e/0xb40 [ 106.992966][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 106.993013][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 106.993086][ T4985] ksys_read+0x12a/0x250 [ 106.993132][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 106.993180][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 106.993228][ T4985] do_syscall_64+0x115/0x870 [ 106.993281][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.993319][ T4985] RIP: 0033:0x7f8fd12a7407 [ 106.993348][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 106.993384][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 106.993419][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 106.993445][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 106.993468][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 106.993492][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 106.993515][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 106.993555][ T4985] [ 106.993568][ T4985] [ 107.340686][ T4985] Allocated by task 186: [ 107.344984][ T4985] kasan_save_stack+0x30/0x50 [ 107.349730][ T4985] kasan_save_track+0x14/0x30 [ 107.354446][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 107.359083][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 107.364484][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 107.369521][ T4985] usb_probe_interface+0x303/0x8f0 [ 107.374677][ T4985] really_probe+0x241/0xa60 [ 107.379211][ T4985] __driver_probe_device+0x20e/0x450 [ 107.384529][ T4985] driver_probe_device+0x4a/0x140 [ 107.389598][ T4985] __device_attach_driver+0x1df/0x320 [ 107.394999][ T4985] bus_for_each_drv+0x159/0x1e0 [ 107.399862][ T4985] __device_attach+0x1e4/0x4d0 [ 107.404649][ T4985] device_initial_probe+0xaf/0xd0 [ 107.409816][ T4985] bus_probe_device+0x64/0x160 [ 107.414634][ T4985] device_add+0x121d/0x1970 [ 107.419207][ T4985] usb_set_configuration+0xd97/0x1c60 [ 107.424614][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 107.430040][ T4985] usb_probe_device+0xef/0x400 [ 107.434839][ T4985] really_probe+0x241/0xa60 [ 107.439368][ T4985] __driver_probe_device+0x20e/0x450 [ 107.444686][ T4985] driver_probe_device+0x4a/0x140 [ 107.449741][ T4985] __device_attach_driver+0x1df/0x320 [ 107.455145][ T4985] bus_for_each_drv+0x159/0x1e0 [ 107.460013][ T4985] __device_attach+0x1e4/0x4d0 [ 107.464924][ T4985] device_initial_probe+0xaf/0xd0 [ 107.469977][ T4985] bus_probe_device+0x64/0x160 [ 107.474760][ T4985] device_add+0x121d/0x1970 [ 107.479299][ T4985] usb_new_device.cold+0x685/0x115c [ 107.484514][ T4985] hub_event+0x30a3/0x4a60 [ 107.488963][ T4985] process_one_work+0xa23/0x1940 [ 107.493995][ T4985] worker_thread+0x5ef/0xe50 [ 107.498589][ T4985] kthread+0x370/0x450 [ 107.502687][ T4985] ret_from_fork+0x72b/0xd50 [ 107.507296][ T4985] ret_from_fork_asm+0x1a/0x30 [ 107.512086][ T4985] [ 107.514401][ T4985] Freed by task 186: [ 107.518286][ T4985] kasan_save_stack+0x30/0x50 [ 107.522993][ T4985] kasan_save_track+0x14/0x30 [ 107.527703][ T4985] kasan_save_free_info+0x3b/0x70 [ 107.532748][ T4985] __kasan_slab_free+0x5f/0x80 [ 107.537522][ T4985] kfree+0x22b/0x6c0 [ 107.541441][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 107.546563][ T4985] usb_probe_interface+0x303/0x8f0 [ 107.551704][ T4985] really_probe+0x241/0xa60 [ 107.556230][ T4985] __driver_probe_device+0x20e/0x450 [ 107.561673][ T4985] driver_probe_device+0x4a/0x140 [ 107.566728][ T4985] __device_attach_driver+0x1df/0x320 [ 107.572133][ T4985] bus_for_each_drv+0x159/0x1e0 [ 107.577006][ T4985] __device_attach+0x1e4/0x4d0 [ 107.581806][ T4985] device_initial_probe+0xaf/0xd0 [ 107.586864][ T4985] bus_probe_device+0x64/0x160 [ 107.591656][ T4985] device_add+0x121d/0x1970 [ 107.596189][ T4985] usb_set_configuration+0xd97/0x1c60 [ 107.601588][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 107.606979][ T4985] usb_probe_device+0xef/0x400 [ 107.611772][ T4985] really_probe+0x241/0xa60 [ 107.616312][ T4985] __driver_probe_device+0x20e/0x450 [ 107.621640][ T4985] driver_probe_device+0x4a/0x140 [ 107.626710][ T4985] __device_attach_driver+0x1df/0x320 [ 107.632117][ T4985] bus_for_each_drv+0x159/0x1e0 [ 107.636987][ T4985] __device_attach+0x1e4/0x4d0 [ 107.641781][ T4985] device_initial_probe+0xaf/0xd0 [ 107.646838][ T4985] bus_probe_device+0x64/0x160 [ 107.651623][ T4985] device_add+0x121d/0x1970 [ 107.656160][ T4985] usb_new_device.cold+0x685/0x115c [ 107.661382][ T4985] hub_event+0x30a3/0x4a60 [ 107.665825][ T4985] process_one_work+0xa23/0x1940 [ 107.670769][ T4985] worker_thread+0x5ef/0xe50 [ 107.675371][ T4985] kthread+0x370/0x450 [ 107.679473][ T4985] ret_from_fork+0x72b/0xd50 [ 107.684079][ T4985] ret_from_fork_asm+0x1a/0x30 [ 107.688877][ T4985] [ 107.691194][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 107.691194][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 107.705254][ T4985] The buggy address is located 1880 bytes inside of [ 107.705254][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 107.719424][ T4985] [ 107.721766][ T4985] The buggy address belongs to the physical page: [ 107.728270][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 107.737165][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 107.745709][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 107.753308][ T4985] page_type: f5(slab) [ 107.757327][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 107.766013][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 107.774639][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 107.783412][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 107.792094][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 107.800792][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 107.809473][ T4985] page dumped because: kasan: bad access detected [ 107.815884][ T4985] page_owner tracks the page as allocated [ 107.821598][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 107.843089][ T4985] post_alloc_hook+0xfd/0x120 [ 107.847800][ T4985] get_page_from_freelist+0xf48/0x3530 [ 107.853297][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 107.859237][ T4985] new_slab+0xa2/0x640 [ 107.863356][ T4985] refill_objects+0xe3/0x410 [ 107.867987][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 107.873563][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 107.878960][ T4985] rtnl_newlink+0x126/0x2380 [ 107.883580][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 107.888635][ T4985] netlink_rcv_skb+0x159/0x420 [ 107.893412][ T4985] netlink_unicast+0x585/0x850 [ 107.898191][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 107.902968][ T4985] __sys_sendto+0x48b/0x4e0 [ 107.907487][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 107.912269][ T4985] do_syscall_64+0x115/0x870 [ 107.916885][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.922797][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 107.929122][ T4985] __free_frozen_pages+0x79f/0x1090 [ 107.934335][ T4985] qlist_free_all+0x47/0xf0 [ 107.938889][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 107.944380][ T4985] __kasan_slab_alloc+0x69/0x90 [ 107.949241][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 107.954738][ T4985] do_getname+0x35/0x390 [ 107.959079][ T4985] vfs_fstatat+0xd0/0xe0 [ 107.963328][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 107.968365][ T4985] do_syscall_64+0x115/0x870 [ 107.973069][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.979065][ T4985] [ 107.981382][ T4985] Memory state around the buggy address: [ 107.987009][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.995076][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.003232][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.011292][ T4985] ^ [ 108.018228][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.026294][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.034371][ T4985] ================================================================== [ 108.139434][ T30] usb 3-1: USB disconnect, device number 2 [ 108.154007][ T5879] fido_id[5879]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 108.207550][ T4985] Disabling lock debugging due to kernel taint [ 108.213925][ T4985] ================================================================== [ 108.221993][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 108.228956][ T4985] Read of size 1 at addr ffff8880264bb759 by task udevd/4985 [ 108.236342][ T4985] [ 108.238785][ T4985] CPU: 1 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 108.238841][ T4985] Tainted: [B]=BAD_PAGE [ 108.238855][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 108.238877][ T4985] Call Trace: [ 108.238889][ T4985] [ 108.238903][ T4985] dump_stack_lvl+0x100/0x190 [ 108.238951][ T4985] print_report+0x13d/0x4b0 [ 108.239006][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.239062][ T4985] ? __virt_addr_valid+0x239/0x430 [ 108.239110][ T4985] ? string+0x471/0x4d0 [ 108.239152][ T4985] kasan_report+0xdf/0x1c0 [ 108.239190][ T4985] ? string+0x471/0x4d0 [ 108.239235][ T4985] string+0x471/0x4d0 [ 108.239278][ T4985] ? __pfx_string+0x10/0x10 [ 108.239326][ T4985] vsnprintf+0x422/0x1300 [ 108.239379][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 108.239423][ T4985] ? ksys_read+0x12a/0x250 [ 108.239467][ T4985] ? do_syscall_64+0x115/0x870 [ 108.239515][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.239558][ T4985] add_uevent_var+0x183/0x3a0 [ 108.239605][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 108.239651][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 108.239689][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 108.239725][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 108.239761][ T4985] dev_uevent+0x2f1/0x870 [ 108.239796][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 108.239826][ T4985] ? kasan_save_track+0x14/0x30 [ 108.239886][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.239931][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 108.239988][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.240032][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 108.240092][ T4985] ? uevent_show+0x166/0x3a0 [ 108.240141][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 108.240187][ T4985] uevent_show+0x1ca/0x3a0 [ 108.240234][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.240281][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 108.240327][ T4985] dev_attr_show+0x52/0xa0 [ 108.240382][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 108.240441][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 108.240494][ T4985] seq_read_iter+0x32f/0x1270 [ 108.240553][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 108.240594][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.240636][ T4985] ? rw_verify_area+0xce/0x6d0 [ 108.240677][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 108.240721][ T4985] vfs_read+0x82e/0xb40 [ 108.240770][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 108.240816][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 108.240890][ T4985] ksys_read+0x12a/0x250 [ 108.240936][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 108.240984][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.241029][ T4985] do_syscall_64+0x115/0x870 [ 108.241092][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.241132][ T4985] RIP: 0033:0x7f8fd12a7407 [ 108.241161][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 108.241197][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 108.241233][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 108.241258][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 108.241282][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 108.241305][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 108.241328][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 108.241364][ T4985] [ 108.241377][ T4985] [ 108.578948][ T4985] Allocated by task 186: [ 108.583214][ T4985] kasan_save_stack+0x30/0x50 [ 108.587946][ T4985] kasan_save_track+0x14/0x30 [ 108.592737][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 108.597362][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 108.602836][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 108.607871][ T4985] usb_probe_interface+0x303/0x8f0 [ 108.613100][ T4985] really_probe+0x241/0xa60 [ 108.617632][ T4985] __driver_probe_device+0x20e/0x450 [ 108.622954][ T4985] driver_probe_device+0x4a/0x140 [ 108.627995][ T4985] __device_attach_driver+0x1df/0x320 [ 108.633386][ T4985] bus_for_each_drv+0x159/0x1e0 [ 108.638249][ T4985] __device_attach+0x1e4/0x4d0 [ 108.643031][ T4985] device_initial_probe+0xaf/0xd0 [ 108.648083][ T4985] bus_probe_device+0x64/0x160 [ 108.652861][ T4985] device_add+0x121d/0x1970 [ 108.657395][ T4985] usb_set_configuration+0xd97/0x1c60 [ 108.662789][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 108.668171][ T4985] usb_probe_device+0xef/0x400 [ 108.672965][ T4985] really_probe+0x241/0xa60 [ 108.677499][ T4985] __driver_probe_device+0x20e/0x450 [ 108.682812][ T4985] driver_probe_device+0x4a/0x140 [ 108.687865][ T4985] __device_attach_driver+0x1df/0x320 [ 108.693266][ T4985] bus_for_each_drv+0x159/0x1e0 [ 108.698147][ T4985] __device_attach+0x1e4/0x4d0 [ 108.703017][ T4985] device_initial_probe+0xaf/0xd0 [ 108.708151][ T4985] bus_probe_device+0x64/0x160 [ 108.712925][ T4985] device_add+0x121d/0x1970 [ 108.717572][ T4985] usb_new_device.cold+0x685/0x115c [ 108.722786][ T4985] hub_event+0x30a3/0x4a60 [ 108.727233][ T4985] process_one_work+0xa23/0x1940 [ 108.732206][ T4985] worker_thread+0x5ef/0xe50 [ 108.736974][ T4985] kthread+0x370/0x450 [ 108.741159][ T4985] ret_from_fork+0x72b/0xd50 [ 108.745764][ T4985] ret_from_fork_asm+0x1a/0x30 [ 108.750548][ T4985] [ 108.752862][ T4985] Freed by task 186: [ 108.756743][ T4985] kasan_save_stack+0x30/0x50 [ 108.761444][ T4985] kasan_save_track+0x14/0x30 [ 108.766154][ T4985] kasan_save_free_info+0x3b/0x70 [ 108.771192][ T4985] __kasan_slab_free+0x5f/0x80 [ 108.775960][ T4985] kfree+0x22b/0x6c0 [ 108.779869][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 108.784984][ T4985] usb_probe_interface+0x303/0x8f0 [ 108.790121][ T4985] really_probe+0x241/0xa60 [ 108.794646][ T4985] __driver_probe_device+0x20e/0x450 [ 108.799953][ T4985] driver_probe_device+0x4a/0x140 [ 108.805004][ T4985] __device_attach_driver+0x1df/0x320 [ 108.810395][ T4985] bus_for_each_drv+0x159/0x1e0 [ 108.815253][ T4985] __device_attach+0x1e4/0x4d0 [ 108.820035][ T4985] device_initial_probe+0xaf/0xd0 [ 108.825111][ T4985] bus_probe_device+0x64/0x160 [ 108.829888][ T4985] device_add+0x121d/0x1970 [ 108.834424][ T4985] usb_set_configuration+0xd97/0x1c60 [ 108.839820][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 108.845205][ T4985] usb_probe_device+0xef/0x400 [ 108.849987][ T4985] really_probe+0x241/0xa60 [ 108.854518][ T4985] __driver_probe_device+0x20e/0x450 [ 108.859845][ T4985] driver_probe_device+0x4a/0x140 [ 108.865069][ T4985] __device_attach_driver+0x1df/0x320 [ 108.870492][ T4985] bus_for_each_drv+0x159/0x1e0 [ 108.875355][ T4985] __device_attach+0x1e4/0x4d0 [ 108.880164][ T4985] device_initial_probe+0xaf/0xd0 [ 108.885234][ T4985] bus_probe_device+0x64/0x160 [ 108.890020][ T4985] device_add+0x121d/0x1970 [ 108.894549][ T4985] usb_new_device.cold+0x685/0x115c [ 108.899770][ T4985] hub_event+0x30a3/0x4a60 [ 108.904212][ T4985] process_one_work+0xa23/0x1940 [ 108.909160][ T4985] worker_thread+0x5ef/0xe50 [ 108.913752][ T4985] kthread+0x370/0x450 [ 108.917848][ T4985] ret_from_fork+0x72b/0xd50 [ 108.922465][ T4985] ret_from_fork_asm+0x1a/0x30 [ 108.927249][ T4985] [ 108.929566][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 108.929566][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 108.943620][ T4985] The buggy address is located 1881 bytes inside of [ 108.943620][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 108.957603][ T4985] [ 108.959927][ T4985] The buggy address belongs to the physical page: [ 108.966328][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 108.975094][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 108.983600][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 108.991175][ T4985] page_type: f5(slab) [ 108.995180][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 109.003782][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 109.012383][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 109.021074][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 109.029771][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 109.038464][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 109.047142][ T4985] page dumped because: kasan: bad access detected [ 109.053561][ T4985] page_owner tracks the page as allocated [ 109.059716][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 109.081206][ T4985] post_alloc_hook+0xfd/0x120 [ 109.086010][ T4985] get_page_from_freelist+0xf48/0x3530 [ 109.091503][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 109.097429][ T4985] new_slab+0xa2/0x640 [ 109.101520][ T4985] refill_objects+0xe3/0x410 [ 109.106158][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 109.111780][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 109.117184][ T4985] rtnl_newlink+0x126/0x2380 [ 109.121808][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 109.126787][ T4985] netlink_rcv_skb+0x159/0x420 [ 109.131584][ T4985] netlink_unicast+0x585/0x850 [ 109.136379][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 109.141176][ T4985] __sys_sendto+0x48b/0x4e0 [ 109.145708][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 109.150488][ T4985] do_syscall_64+0x115/0x870 [ 109.155097][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.161008][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 109.167338][ T4985] __free_frozen_pages+0x79f/0x1090 [ 109.172565][ T4985] qlist_free_all+0x47/0xf0 [ 109.177101][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 109.182609][ T4985] __kasan_slab_alloc+0x69/0x90 [ 109.187487][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 109.192983][ T4985] do_getname+0x35/0x390 [ 109.197475][ T4985] vfs_fstatat+0xd0/0xe0 [ 109.201750][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 109.206808][ T4985] do_syscall_64+0x115/0x870 [ 109.211434][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.217346][ T4985] [ 109.219669][ T4985] Memory state around the buggy address: [ 109.225304][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.233381][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.241455][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.249527][ T4985] ^ [ 109.256475][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.264548][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 109.272610][ T4985] ================================================================== [ 109.403233][ T4985] ================================================================== [ 109.411341][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 109.418414][ T4985] Read of size 1 at addr ffff8880264bb75a by task udevd/4985 [ 109.425802][ T4985] [ 109.428139][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 109.428194][ T4985] Tainted: [B]=BAD_PAGE [ 109.428208][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 109.428231][ T4985] Call Trace: [ 109.428243][ T4985] [ 109.428257][ T4985] dump_stack_lvl+0x100/0x190 [ 109.428302][ T4985] print_report+0x13d/0x4b0 [ 109.428357][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 109.428410][ T4985] ? __virt_addr_valid+0x239/0x430 [ 109.428458][ T4985] ? string+0x471/0x4d0 [ 109.428500][ T4985] kasan_report+0xdf/0x1c0 [ 109.428542][ T4985] ? string+0x471/0x4d0 [ 109.428589][ T4985] string+0x471/0x4d0 [ 109.428633][ T4985] ? __pfx_string+0x10/0x10 [ 109.428681][ T4985] vsnprintf+0x422/0x1300 [ 109.428735][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 109.428785][ T4985] ? ksys_read+0x12a/0x250 [ 109.428832][ T4985] ? do_syscall_64+0x115/0x870 [ 109.428883][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.428928][ T4985] add_uevent_var+0x183/0x3a0 [ 109.428969][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 109.429016][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 109.429055][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 109.429091][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 109.429128][ T4985] dev_uevent+0x2f1/0x870 [ 109.429165][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 109.429199][ T4985] ? kasan_save_track+0x14/0x30 [ 109.429260][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 109.429307][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 109.429368][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 109.429420][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 109.429473][ T4985] ? uevent_show+0x166/0x3a0 [ 109.429525][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 109.429573][ T4985] uevent_show+0x1ca/0x3a0 [ 109.429621][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 109.429668][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 109.429715][ T4985] dev_attr_show+0x52/0xa0 [ 109.429775][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 109.429836][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 109.429889][ T4985] seq_read_iter+0x32f/0x1270 [ 109.429951][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 109.429995][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 109.430040][ T4985] ? rw_verify_area+0xce/0x6d0 [ 109.430083][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 109.430128][ T4985] vfs_read+0x82e/0xb40 [ 109.430178][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 109.430231][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 109.430307][ T4985] ksys_read+0x12a/0x250 [ 109.430355][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 109.430411][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 109.430461][ T4985] do_syscall_64+0x115/0x870 [ 109.430516][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.430556][ T4985] RIP: 0033:0x7f8fd12a7407 [ 109.430585][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 109.430622][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 109.430657][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 109.430683][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 109.430707][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 109.430731][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 109.430755][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 109.430791][ T4985] [ 109.430803][ T4985] [ 109.767770][ T4985] Allocated by task 186: [ 109.772004][ T4985] kasan_save_stack+0x30/0x50 [ 109.776773][ T4985] kasan_save_track+0x14/0x30 [ 109.781483][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 109.786101][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 109.791495][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 109.796523][ T4985] usb_probe_interface+0x303/0x8f0 [ 109.801662][ T4985] really_probe+0x241/0xa60 [ 109.806274][ T4985] __driver_probe_device+0x20e/0x450 [ 109.811589][ T4985] driver_probe_device+0x4a/0x140 [ 109.816818][ T4985] __device_attach_driver+0x1df/0x320 [ 109.822219][ T4985] bus_for_each_drv+0x159/0x1e0 [ 109.827091][ T4985] __device_attach+0x1e4/0x4d0 [ 109.831891][ T4985] device_initial_probe+0xaf/0xd0 [ 109.836960][ T4985] bus_probe_device+0x64/0x160 [ 109.841763][ T4985] device_add+0x121d/0x1970 [ 109.846314][ T4985] usb_set_configuration+0xd97/0x1c60 [ 109.851724][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 109.857131][ T4985] usb_probe_device+0xef/0x400 [ 109.861935][ T4985] really_probe+0x241/0xa60 [ 109.866474][ T4985] __driver_probe_device+0x20e/0x450 [ 109.872670][ T4985] driver_probe_device+0x4a/0x140 [ 109.877728][ T4985] __device_attach_driver+0x1df/0x320 [ 109.883138][ T4985] bus_for_each_drv+0x159/0x1e0 [ 109.888022][ T4985] __device_attach+0x1e4/0x4d0 [ 109.892822][ T4985] device_initial_probe+0xaf/0xd0 [ 109.897927][ T4985] bus_probe_device+0x64/0x160 [ 109.902723][ T4985] device_add+0x121d/0x1970 [ 109.907266][ T4985] usb_new_device.cold+0x685/0x115c [ 109.912504][ T4985] hub_event+0x30a3/0x4a60 [ 109.916984][ T4985] process_one_work+0xa23/0x1940 [ 109.921950][ T4985] worker_thread+0x5ef/0xe50 [ 109.926653][ T4985] kthread+0x370/0x450 [ 109.930761][ T4985] ret_from_fork+0x72b/0xd50 [ 109.935382][ T4985] ret_from_fork_asm+0x1a/0x30 [ 109.940185][ T4985] [ 109.942505][ T4985] Freed by task 186: [ 109.946392][ T4985] kasan_save_stack+0x30/0x50 [ 109.951107][ T4985] kasan_save_track+0x14/0x30 [ 109.955823][ T4985] kasan_save_free_info+0x3b/0x70 [ 109.960876][ T4985] __kasan_slab_free+0x5f/0x80 [ 109.965694][ T4985] kfree+0x22b/0x6c0 [ 109.969634][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 109.974925][ T4985] usb_probe_interface+0x303/0x8f0 [ 109.980086][ T4985] really_probe+0x241/0xa60 [ 109.984618][ T4985] __driver_probe_device+0x20e/0x450 [ 109.989946][ T4985] driver_probe_device+0x4a/0x140 [ 109.994993][ T4985] __device_attach_driver+0x1df/0x320 [ 110.000390][ T4985] bus_for_each_drv+0x159/0x1e0 [ 110.005252][ T4985] __device_attach+0x1e4/0x4d0 [ 110.010038][ T4985] device_initial_probe+0xaf/0xd0 [ 110.015088][ T4985] bus_probe_device+0x64/0x160 [ 110.019867][ T4985] device_add+0x121d/0x1970 [ 110.024401][ T4985] usb_set_configuration+0xd97/0x1c60 [ 110.029793][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 110.035181][ T4985] usb_probe_device+0xef/0x400 [ 110.040001][ T4985] really_probe+0x241/0xa60 [ 110.044524][ T4985] __driver_probe_device+0x20e/0x450 [ 110.049829][ T4985] driver_probe_device+0x4a/0x140 [ 110.054871][ T4985] __device_attach_driver+0x1df/0x320 [ 110.060267][ T4985] bus_for_each_drv+0x159/0x1e0 [ 110.065124][ T4985] __device_attach+0x1e4/0x4d0 [ 110.069914][ T4985] device_initial_probe+0xaf/0xd0 [ 110.074958][ T4985] bus_probe_device+0x64/0x160 [ 110.079738][ T4985] device_add+0x121d/0x1970 [ 110.084270][ T4985] usb_new_device.cold+0x685/0x115c [ 110.089481][ T4985] hub_event+0x30a3/0x4a60 [ 110.093916][ T4985] process_one_work+0xa23/0x1940 [ 110.098862][ T4985] worker_thread+0x5ef/0xe50 [ 110.103455][ T4985] kthread+0x370/0x450 [ 110.107552][ T4985] ret_from_fork+0x72b/0xd50 [ 110.112157][ T4985] ret_from_fork_asm+0x1a/0x30 [ 110.116947][ T4985] [ 110.119263][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 110.119263][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 110.133318][ T4985] The buggy address is located 1882 bytes inside of [ 110.133318][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 110.147299][ T4985] [ 110.149623][ T4985] The buggy address belongs to the physical page: [ 110.156025][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 110.164786][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 110.173284][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 110.180855][ T4985] page_type: f5(slab) [ 110.184866][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 110.193479][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 110.202075][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 110.210764][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 110.219455][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 110.228312][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 110.236985][ T4985] page dumped because: kasan: bad access detected [ 110.243408][ T4985] page_owner tracks the page as allocated [ 110.249111][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 110.270631][ T4985] post_alloc_hook+0xfd/0x120 [ 110.275342][ T4985] get_page_from_freelist+0xf48/0x3530 [ 110.280828][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 110.286746][ T4985] new_slab+0xa2/0x640 [ 110.290831][ T4985] refill_objects+0xe3/0x410 [ 110.295436][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 110.301000][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 110.306404][ T4985] rtnl_newlink+0x126/0x2380 [ 110.311086][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 110.316056][ T4985] netlink_rcv_skb+0x159/0x420 [ 110.320843][ T4985] netlink_unicast+0x585/0x850 [ 110.325627][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 110.330409][ T4985] __sys_sendto+0x48b/0x4e0 [ 110.334949][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 110.339752][ T4985] do_syscall_64+0x115/0x870 [ 110.344364][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.350352][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 110.356670][ T4985] __free_frozen_pages+0x79f/0x1090 [ 110.361885][ T4985] qlist_free_all+0x47/0xf0 [ 110.366432][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 110.371929][ T4985] __kasan_slab_alloc+0x69/0x90 [ 110.376796][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 110.382366][ T4985] do_getname+0x35/0x390 [ 110.386622][ T4985] vfs_fstatat+0xd0/0xe0 [ 110.390868][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 110.395901][ T4985] do_syscall_64+0x115/0x870 [ 110.400516][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.406416][ T4985] [ 110.408733][ T4985] Memory state around the buggy address: [ 110.414355][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 110.422764][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 110.430827][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 110.438884][ T4985] ^ [ 110.445815][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 110.453878][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 110.461937][ T4985] ================================================================== [ 110.487044][ T5623] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 110.526245][ T4985] ================================================================== [ 110.534353][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 110.541332][ T4985] Read of size 1 at addr ffff8880264bb75b by task udevd/4985 [ 110.548710][ T4985] [ 110.551045][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 110.551095][ T4985] Tainted: [B]=BAD_PAGE [ 110.551108][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 110.551128][ T4985] Call Trace: [ 110.551139][ T4985] [ 110.551151][ T4985] dump_stack_lvl+0x100/0x190 [ 110.551191][ T4985] print_report+0x13d/0x4b0 [ 110.551243][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 110.551285][ T4985] ? __virt_addr_valid+0x239/0x430 [ 110.551328][ T4985] ? string+0x471/0x4d0 [ 110.551366][ T4985] kasan_report+0xdf/0x1c0 [ 110.551404][ T4985] ? string+0x471/0x4d0 [ 110.551447][ T4985] string+0x471/0x4d0 [ 110.551487][ T4985] ? __pfx_string+0x10/0x10 [ 110.551531][ T4985] vsnprintf+0x422/0x1300 [ 110.551580][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 110.551624][ T4985] ? ksys_read+0x12a/0x250 [ 110.551666][ T4985] ? do_syscall_64+0x115/0x870 [ 110.551712][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.551752][ T4985] add_uevent_var+0x183/0x3a0 [ 110.551790][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 110.551833][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 110.551868][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 110.551901][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 110.551939][ T4985] dev_uevent+0x2f1/0x870 [ 110.551972][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 110.552003][ T4985] ? kasan_save_track+0x14/0x30 [ 110.552057][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 110.552099][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 110.552153][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 110.552195][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 110.552242][ T4985] ? uevent_show+0x166/0x3a0 [ 110.552289][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 110.552332][ T4985] uevent_show+0x1ca/0x3a0 [ 110.552374][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 110.552418][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 110.552461][ T4985] dev_attr_show+0x52/0xa0 [ 110.552517][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 110.552572][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 110.552620][ T4985] seq_read_iter+0x32f/0x1270 [ 110.552677][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 110.552716][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 110.552758][ T4985] ? rw_verify_area+0xce/0x6d0 [ 110.552795][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 110.552835][ T4985] vfs_read+0x82e/0xb40 [ 110.552880][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 110.552930][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 110.552998][ T4985] ksys_read+0x12a/0x250 [ 110.553040][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 110.553090][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 110.553138][ T4985] do_syscall_64+0x115/0x870 [ 110.553187][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.553223][ T4985] RIP: 0033:0x7f8fd12a7407 [ 110.553248][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 110.553282][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 110.553314][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 110.553337][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 110.553359][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 110.553381][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 110.553402][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 110.553435][ T4985] [ 110.553447][ T4985] [ 110.891193][ T4985] Allocated by task 186: [ 110.895427][ T4985] kasan_save_stack+0x30/0x50 [ 110.900143][ T4985] kasan_save_track+0x14/0x30 [ 110.904848][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 110.909463][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 110.914850][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 110.919882][ T4985] usb_probe_interface+0x303/0x8f0 [ 110.925023][ T4985] really_probe+0x241/0xa60 [ 110.929546][ T4985] __driver_probe_device+0x20e/0x450 [ 110.934849][ T4985] driver_probe_device+0x4a/0x140 [ 110.939894][ T4985] __device_attach_driver+0x1df/0x320 [ 110.945290][ T4985] bus_for_each_drv+0x159/0x1e0 [ 110.950169][ T4985] __device_attach+0x1e4/0x4d0 [ 110.954964][ T4985] device_initial_probe+0xaf/0xd0 [ 110.960013][ T4985] bus_probe_device+0x64/0x160 [ 110.964791][ T4985] device_add+0x121d/0x1970 [ 110.969350][ T4985] usb_set_configuration+0xd97/0x1c60 [ 110.974756][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 110.980140][ T4985] usb_probe_device+0xef/0x400 [ 110.984924][ T4985] really_probe+0x241/0xa60 [ 110.989449][ T4985] __driver_probe_device+0x20e/0x450 [ 110.994757][ T4985] driver_probe_device+0x4a/0x140 [ 110.999894][ T4985] __device_attach_driver+0x1df/0x320 [ 111.005291][ T4985] bus_for_each_drv+0x159/0x1e0 [ 111.010152][ T4985] __device_attach+0x1e4/0x4d0 [ 111.014933][ T4985] device_initial_probe+0xaf/0xd0 [ 111.019982][ T4985] bus_probe_device+0x64/0x160 [ 111.024781][ T4985] device_add+0x121d/0x1970 [ 111.029307][ T4985] usb_new_device.cold+0x685/0x115c [ 111.034517][ T4985] hub_event+0x30a3/0x4a60 [ 111.038960][ T4985] process_one_work+0xa23/0x1940 [ 111.043913][ T4985] worker_thread+0x5ef/0xe50 [ 111.048517][ T4985] kthread+0x370/0x450 [ 111.052610][ T4985] ret_from_fork+0x72b/0xd50 [ 111.057215][ T4985] ret_from_fork_asm+0x1a/0x30 [ 111.061998][ T4985] [ 111.064309][ T4985] Freed by task 186: [ 111.068192][ T4985] kasan_save_stack+0x30/0x50 [ 111.072893][ T4985] kasan_save_track+0x14/0x30 [ 111.077597][ T4985] kasan_save_free_info+0x3b/0x70 [ 111.082659][ T4985] __kasan_slab_free+0x5f/0x80 [ 111.087427][ T4985] kfree+0x22b/0x6c0 [ 111.091334][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 111.096447][ T4985] usb_probe_interface+0x303/0x8f0 [ 111.101585][ T4985] really_probe+0x241/0xa60 [ 111.106140][ T4985] __driver_probe_device+0x20e/0x450 [ 111.111446][ T4985] driver_probe_device+0x4a/0x140 [ 111.116493][ T4985] __device_attach_driver+0x1df/0x320 [ 111.122320][ T4985] bus_for_each_drv+0x159/0x1e0 [ 111.127180][ T4985] __device_attach+0x1e4/0x4d0 [ 111.132051][ T4985] device_initial_probe+0xaf/0xd0 [ 111.137102][ T4985] bus_probe_device+0x64/0x160 [ 111.141978][ T4985] device_add+0x121d/0x1970 [ 111.146509][ T4985] usb_set_configuration+0xd97/0x1c60 [ 111.151904][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 111.157336][ T4985] usb_probe_device+0xef/0x400 [ 111.162125][ T4985] really_probe+0x241/0xa60 [ 111.166646][ T4985] __driver_probe_device+0x20e/0x450 [ 111.171957][ T4985] driver_probe_device+0x4a/0x140 [ 111.176998][ T4985] __device_attach_driver+0x1df/0x320 [ 111.182396][ T4985] bus_for_each_drv+0x159/0x1e0 [ 111.187256][ T4985] __device_attach+0x1e4/0x4d0 [ 111.192037][ T4985] device_initial_probe+0xaf/0xd0 [ 111.197080][ T4985] bus_probe_device+0x64/0x160 [ 111.201858][ T4985] device_add+0x121d/0x1970 [ 111.206387][ T4985] usb_new_device.cold+0x685/0x115c [ 111.211599][ T4985] hub_event+0x30a3/0x4a60 [ 111.216034][ T4985] process_one_work+0xa23/0x1940 [ 111.220978][ T4985] worker_thread+0x5ef/0xe50 [ 111.226005][ T4985] kthread+0x370/0x450 [ 111.230184][ T4985] ret_from_fork+0x72b/0xd50 [ 111.234792][ T4985] ret_from_fork_asm+0x1a/0x30 [ 111.239586][ T4985] [ 111.241907][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 111.241907][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 111.255973][ T4985] The buggy address is located 1883 bytes inside of [ 111.255973][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 111.269952][ T4985] [ 111.272271][ T4985] The buggy address belongs to the physical page: [ 111.278672][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 111.287433][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 111.295955][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 111.303523][ T4985] page_type: f5(slab) [ 111.307507][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 111.316099][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 111.324713][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 111.333413][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 111.342097][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 111.350785][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 111.359547][ T4985] page dumped because: kasan: bad access detected [ 111.365951][ T4985] page_owner tracks the page as allocated [ 111.371657][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 111.393212][ T4985] post_alloc_hook+0xfd/0x120 [ 111.397938][ T4985] get_page_from_freelist+0xf48/0x3530 [ 111.403416][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 111.409338][ T4985] new_slab+0xa2/0x640 [ 111.413417][ T4985] refill_objects+0xe3/0x410 [ 111.418031][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 111.423590][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 111.428979][ T4985] rtnl_newlink+0x126/0x2380 [ 111.433588][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 111.438549][ T4985] netlink_rcv_skb+0x159/0x420 [ 111.443322][ T4985] netlink_unicast+0x585/0x850 [ 111.448093][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 111.452866][ T4985] __sys_sendto+0x48b/0x4e0 [ 111.457382][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 111.462162][ T4985] do_syscall_64+0x115/0x870 [ 111.466771][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.472666][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 111.478986][ T4985] __free_frozen_pages+0x79f/0x1090 [ 111.484196][ T4985] qlist_free_all+0x47/0xf0 [ 111.488719][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 111.494199][ T4985] __kasan_slab_alloc+0x69/0x90 [ 111.499052][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 111.504531][ T4985] do_getname+0x35/0x390 [ 111.508862][ T4985] vfs_fstatat+0xd0/0xe0 [ 111.513099][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 111.518121][ T4985] do_syscall_64+0x115/0x870 [ 111.522724][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.528619][ T4985] [ 111.530935][ T4985] Memory state around the buggy address: [ 111.536555][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.544612][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.552761][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.560821][ T4985] ^ [ 111.567748][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.575805][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 111.583857][ T4985] ================================================================== [ 111.611425][ T5766] usbhid 2-1:1.0: can't add hid device: -71 [ 111.617919][ T5766] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 111.636532][ T4985] ================================================================== [ 111.637186][ T5766] usb 2-1: USB disconnect, device number 2 [ 111.644606][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 111.644659][ T4985] Read of size 1 at addr ffff8880264bb75c by task udevd/4985 [ 111.664888][ T4985] [ 111.667270][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 111.667326][ T4985] Tainted: [B]=BAD_PAGE [ 111.667340][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 111.667362][ T4985] Call Trace: [ 111.667374][ T4985] [ 111.667388][ T4985] dump_stack_lvl+0x100/0x190 [ 111.667434][ T4985] print_report+0x13d/0x4b0 [ 111.667498][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.667545][ T4985] ? __virt_addr_valid+0x239/0x430 [ 111.667593][ T4985] ? string+0x471/0x4d0 [ 111.667636][ T4985] kasan_report+0xdf/0x1c0 [ 111.667678][ T4985] ? string+0x471/0x4d0 [ 111.667725][ T4985] string+0x471/0x4d0 [ 111.667769][ T4985] ? __pfx_string+0x10/0x10 [ 111.667818][ T4985] vsnprintf+0x422/0x1300 [ 111.667873][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 111.667922][ T4985] ? ksys_read+0x12a/0x250 [ 111.667968][ T4985] ? do_syscall_64+0x115/0x870 [ 111.668019][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.668069][ T4985] add_uevent_var+0x183/0x3a0 [ 111.668111][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 111.668158][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 111.668198][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 111.668235][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 111.668273][ T4985] dev_uevent+0x2f1/0x870 [ 111.668309][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 111.668343][ T4985] ? kasan_save_track+0x14/0x30 [ 111.668402][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.668448][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 111.668516][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.668562][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 111.668616][ T4985] ? uevent_show+0x166/0x3a0 [ 111.668668][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 111.668716][ T4985] uevent_show+0x1ca/0x3a0 [ 111.668764][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.668813][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 111.668860][ T4985] dev_attr_show+0x52/0xa0 [ 111.668921][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 111.668982][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 111.669036][ T4985] seq_read_iter+0x32f/0x1270 [ 111.669098][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 111.669140][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.669186][ T4985] ? rw_verify_area+0xce/0x6d0 [ 111.669227][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 111.669271][ T4985] vfs_read+0x82e/0xb40 [ 111.669319][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 111.669368][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 111.669443][ T4985] ksys_read+0x12a/0x250 [ 111.669496][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 111.669546][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.669600][ T4985] do_syscall_64+0x115/0x870 [ 111.669655][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.669691][ T4985] RIP: 0033:0x7f8fd12a7407 [ 111.669718][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 111.669754][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 111.669789][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 111.669815][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 111.669839][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 111.669862][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 111.669885][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 111.669951][ T4985] [ 111.669963][ T4985] [ 112.007559][ T4985] Allocated by task 186: [ 112.011835][ T4985] kasan_save_stack+0x30/0x50 [ 112.016556][ T4985] kasan_save_track+0x14/0x30 [ 112.021263][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 112.025880][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 112.031355][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 112.036384][ T4985] usb_probe_interface+0x303/0x8f0 [ 112.041531][ T4985] really_probe+0x241/0xa60 [ 112.046050][ T4985] __driver_probe_device+0x20e/0x450 [ 112.051371][ T4985] driver_probe_device+0x4a/0x140 [ 112.056416][ T4985] __device_attach_driver+0x1df/0x320 [ 112.061825][ T4985] bus_for_each_drv+0x159/0x1e0 [ 112.066706][ T4985] __device_attach+0x1e4/0x4d0 [ 112.071489][ T4985] device_initial_probe+0xaf/0xd0 [ 112.076533][ T4985] bus_probe_device+0x64/0x160 [ 112.081331][ T4985] device_add+0x121d/0x1970 [ 112.085859][ T4985] usb_set_configuration+0xd97/0x1c60 [ 112.091248][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 112.096686][ T4985] usb_probe_device+0xef/0x400 [ 112.101474][ T4985] really_probe+0x241/0xa60 [ 112.105996][ T4985] __driver_probe_device+0x20e/0x450 [ 112.111305][ T4985] driver_probe_device+0x4a/0x140 [ 112.116356][ T4985] __device_attach_driver+0x1df/0x320 [ 112.121752][ T4985] bus_for_each_drv+0x159/0x1e0 [ 112.126612][ T4985] __device_attach+0x1e4/0x4d0 [ 112.131394][ T4985] device_initial_probe+0xaf/0xd0 [ 112.136441][ T4985] bus_probe_device+0x64/0x160 [ 112.141220][ T4985] device_add+0x121d/0x1970 [ 112.145756][ T4985] usb_new_device.cold+0x685/0x115c [ 112.151053][ T4985] hub_event+0x30a3/0x4a60 [ 112.155493][ T4985] process_one_work+0xa23/0x1940 [ 112.160434][ T4985] worker_thread+0x5ef/0xe50 [ 112.165039][ T4985] kthread+0x370/0x450 [ 112.169180][ T4985] ret_from_fork+0x72b/0xd50 [ 112.173787][ T4985] ret_from_fork_asm+0x1a/0x30 [ 112.178574][ T4985] [ 112.180949][ T4985] Freed by task 186: [ 112.184875][ T4985] kasan_save_stack+0x30/0x50 [ 112.189579][ T4985] kasan_save_track+0x14/0x30 [ 112.194283][ T4985] kasan_save_free_info+0x3b/0x70 [ 112.199326][ T4985] __kasan_slab_free+0x5f/0x80 [ 112.204094][ T4985] kfree+0x22b/0x6c0 [ 112.208006][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 112.213122][ T4985] usb_probe_interface+0x303/0x8f0 [ 112.218346][ T4985] really_probe+0x241/0xa60 [ 112.222868][ T4985] __driver_probe_device+0x20e/0x450 [ 112.228184][ T4985] driver_probe_device+0x4a/0x140 [ 112.233317][ T4985] __device_attach_driver+0x1df/0x320 [ 112.238800][ T4985] bus_for_each_drv+0x159/0x1e0 [ 112.243665][ T4985] __device_attach+0x1e4/0x4d0 [ 112.248448][ T4985] device_initial_probe+0xaf/0xd0 [ 112.253501][ T4985] bus_probe_device+0x64/0x160 [ 112.258277][ T4985] device_add+0x121d/0x1970 [ 112.262805][ T4985] usb_set_configuration+0xd97/0x1c60 [ 112.268198][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 112.273586][ T4985] usb_probe_device+0xef/0x400 [ 112.278376][ T4985] really_probe+0x241/0xa60 [ 112.282896][ T4985] __driver_probe_device+0x20e/0x450 [ 112.288203][ T4985] driver_probe_device+0x4a/0x140 [ 112.293335][ T4985] __device_attach_driver+0x1df/0x320 [ 112.298732][ T4985] bus_for_each_drv+0x159/0x1e0 [ 112.303680][ T4985] __device_attach+0x1e4/0x4d0 [ 112.308471][ T4985] device_initial_probe+0xaf/0xd0 [ 112.313518][ T4985] bus_probe_device+0x64/0x160 [ 112.318299][ T4985] device_add+0x121d/0x1970 [ 112.322828][ T4985] usb_new_device.cold+0x685/0x115c [ 112.328038][ T4985] hub_event+0x30a3/0x4a60 [ 112.332482][ T4985] process_one_work+0xa23/0x1940 [ 112.337422][ T4985] worker_thread+0x5ef/0xe50 [ 112.342034][ T4985] kthread+0x370/0x450 [ 112.346130][ T4985] ret_from_fork+0x72b/0xd50 [ 112.350741][ T4985] ret_from_fork_asm+0x1a/0x30 [ 112.355527][ T4985] [ 112.357849][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 112.357849][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 112.371995][ T4985] The buggy address is located 1884 bytes inside of [ 112.371995][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 112.386082][ T4985] [ 112.388409][ T4985] The buggy address belongs to the physical page: [ 112.394864][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 112.403722][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 112.412279][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 112.419832][ T4985] page_type: f5(slab) [ 112.423830][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 112.432419][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 112.441015][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 112.449697][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 112.458383][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 112.467147][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 112.475813][ T4985] page dumped because: kasan: bad access detected [ 112.482224][ T4985] page_owner tracks the page as allocated [ 112.488102][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 112.509582][ T4985] post_alloc_hook+0xfd/0x120 [ 112.514303][ T4985] get_page_from_freelist+0xf48/0x3530 [ 112.519793][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 112.525715][ T4985] new_slab+0xa2/0x640 [ 112.529816][ T4985] refill_objects+0xe3/0x410 [ 112.534428][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 112.539994][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 112.545383][ T4985] rtnl_newlink+0x126/0x2380 [ 112.550008][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 112.554969][ T4985] netlink_rcv_skb+0x159/0x420 [ 112.559754][ T4985] netlink_unicast+0x585/0x850 [ 112.564536][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 112.569326][ T4985] __sys_sendto+0x48b/0x4e0 [ 112.573853][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 112.578648][ T4985] do_syscall_64+0x115/0x870 [ 112.583267][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.589173][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 112.595496][ T4985] __free_frozen_pages+0x79f/0x1090 [ 112.600721][ T4985] qlist_free_all+0x47/0xf0 [ 112.605251][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 112.610830][ T4985] __kasan_slab_alloc+0x69/0x90 [ 112.615803][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 112.621475][ T4985] do_getname+0x35/0x390 [ 112.625750][ T4985] vfs_fstatat+0xd0/0xe0 [ 112.630014][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 112.635059][ T4985] do_syscall_64+0x115/0x870 [ 112.639677][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.645608][ T4985] [ 112.647924][ T4985] Memory state around the buggy address: [ 112.653556][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.661628][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.669694][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.677754][ T4985] ^ [ 112.684688][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.692754][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 112.700829][ T4985] ================================================================== [ 112.744191][ T4985] ================================================================== [ 112.752295][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 112.759262][ T4985] Read of size 1 at addr ffff8880264bb75d by task udevd/4985 [ 112.766651][ T4985] [ 112.769000][ T4985] CPU: 1 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 112.769055][ T4985] Tainted: [B]=BAD_PAGE [ 112.769069][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 112.769092][ T4985] Call Trace: [ 112.769104][ T4985] [ 112.769117][ T4985] dump_stack_lvl+0x100/0x190 [ 112.769162][ T4985] print_report+0x13d/0x4b0 [ 112.769219][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 112.769267][ T4985] ? __virt_addr_valid+0x239/0x430 [ 112.769316][ T4985] ? string+0x471/0x4d0 [ 112.769359][ T4985] kasan_report+0xdf/0x1c0 [ 112.769401][ T4985] ? string+0x471/0x4d0 [ 112.769448][ T4985] string+0x471/0x4d0 [ 112.769492][ T4985] ? __pfx_string+0x10/0x10 [ 112.769542][ T4985] vsnprintf+0x422/0x1300 [ 112.769602][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 112.769650][ T4985] ? ksys_read+0x12a/0x250 [ 112.769714][ T4985] ? do_syscall_64+0x115/0x870 [ 112.769763][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.769807][ T4985] add_uevent_var+0x183/0x3a0 [ 112.769849][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 112.769896][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 112.769941][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 112.769977][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 112.770012][ T4985] dev_uevent+0x2f1/0x870 [ 112.770050][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 112.770084][ T4985] ? kasan_save_track+0x14/0x30 [ 112.770145][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 112.770191][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 112.770251][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 112.770297][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 112.770351][ T4985] ? uevent_show+0x166/0x3a0 [ 112.770403][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 112.770450][ T4985] uevent_show+0x1ca/0x3a0 [ 112.770497][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 112.770546][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 112.770593][ T4985] dev_attr_show+0x52/0xa0 [ 112.770655][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 112.770733][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 112.770786][ T4985] seq_read_iter+0x32f/0x1270 [ 112.770849][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 112.770892][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 112.770945][ T4985] ? rw_verify_area+0xce/0x6d0 [ 112.770987][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 112.771032][ T4985] vfs_read+0x82e/0xb40 [ 112.771081][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 112.771130][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 112.771205][ T4985] ksys_read+0x12a/0x250 [ 112.771253][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 112.771303][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 112.771353][ T4985] do_syscall_64+0x115/0x870 [ 112.771407][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.771445][ T4985] RIP: 0033:0x7f8fd12a7407 [ 112.771472][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 112.771508][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 112.771542][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 112.771568][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 112.771593][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 112.771617][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 112.771641][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 112.771695][ T4985] [ 112.771707][ T4985] [ 113.109279][ T4985] Allocated by task 186: [ 113.113508][ T4985] kasan_save_stack+0x30/0x50 [ 113.118205][ T4985] kasan_save_track+0x14/0x30 [ 113.122899][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 113.127506][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 113.132884][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 113.137903][ T4985] usb_probe_interface+0x303/0x8f0 [ 113.143035][ T4985] really_probe+0x241/0xa60 [ 113.147669][ T4985] __driver_probe_device+0x20e/0x450 [ 113.153318][ T4985] driver_probe_device+0x4a/0x140 [ 113.158379][ T4985] __device_attach_driver+0x1df/0x320 [ 113.163760][ T4985] bus_for_each_drv+0x159/0x1e0 [ 113.168609][ T4985] __device_attach+0x1e4/0x4d0 [ 113.173381][ T4985] device_initial_probe+0xaf/0xd0 [ 113.178417][ T4985] bus_probe_device+0x64/0x160 [ 113.183186][ T4985] device_add+0x121d/0x1970 [ 113.187733][ T4985] usb_set_configuration+0xd97/0x1c60 [ 113.193116][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 113.198678][ T4985] usb_probe_device+0xef/0x400 [ 113.203515][ T4985] really_probe+0x241/0xa60 [ 113.208036][ T4985] __driver_probe_device+0x20e/0x450 [ 113.213519][ T4985] driver_probe_device+0x4a/0x140 [ 113.218554][ T4985] __device_attach_driver+0x1df/0x320 [ 113.223958][ T4985] bus_for_each_drv+0x159/0x1e0 [ 113.228832][ T4985] __device_attach+0x1e4/0x4d0 [ 113.233625][ T4985] device_initial_probe+0xaf/0xd0 [ 113.238661][ T4985] bus_probe_device+0x64/0x160 [ 113.243428][ T4985] device_add+0x121d/0x1970 [ 113.247940][ T4985] usb_new_device.cold+0x685/0x115c [ 113.253148][ T4985] hub_event+0x30a3/0x4a60 [ 113.257593][ T4985] process_one_work+0xa23/0x1940 [ 113.262525][ T4985] worker_thread+0x5ef/0xe50 [ 113.267114][ T4985] kthread+0x370/0x450 [ 113.271199][ T4985] ret_from_fork+0x72b/0xd50 [ 113.275796][ T4985] ret_from_fork_asm+0x1a/0x30 [ 113.280580][ T4985] [ 113.282887][ T4985] Freed by task 186: [ 113.286769][ T4985] kasan_save_stack+0x30/0x50 [ 113.291477][ T4985] kasan_save_track+0x14/0x30 [ 113.296164][ T4985] kasan_save_free_info+0x3b/0x70 [ 113.301191][ T4985] __kasan_slab_free+0x5f/0x80 [ 113.306121][ T4985] kfree+0x22b/0x6c0 [ 113.310029][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 113.315181][ T4985] usb_probe_interface+0x303/0x8f0 [ 113.320306][ T4985] really_probe+0x241/0xa60 [ 113.324903][ T4985] __driver_probe_device+0x20e/0x450 [ 113.330199][ T4985] driver_probe_device+0x4a/0x140 [ 113.335231][ T4985] __device_attach_driver+0x1df/0x320 [ 113.340626][ T4985] bus_for_each_drv+0x159/0x1e0 [ 113.345518][ T4985] __device_attach+0x1e4/0x4d0 [ 113.350293][ T4985] device_initial_probe+0xaf/0xd0 [ 113.355331][ T4985] bus_probe_device+0x64/0x160 [ 113.360102][ T4985] device_add+0x121d/0x1970 [ 113.364623][ T4985] usb_set_configuration+0xd97/0x1c60 [ 113.370009][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 113.375384][ T4985] usb_probe_device+0xef/0x400 [ 113.380160][ T4985] really_probe+0x241/0xa60 [ 113.384680][ T4985] __driver_probe_device+0x20e/0x450 [ 113.389983][ T4985] driver_probe_device+0x4a/0x140 [ 113.395044][ T4985] __device_attach_driver+0x1df/0x320 [ 113.400427][ T4985] bus_for_each_drv+0x159/0x1e0 [ 113.405278][ T4985] __device_attach+0x1e4/0x4d0 [ 113.410059][ T4985] device_initial_probe+0xaf/0xd0 [ 113.415155][ T4985] bus_probe_device+0x64/0x160 [ 113.419944][ T4985] device_add+0x121d/0x1970 [ 113.424487][ T4985] usb_new_device.cold+0x685/0x115c [ 113.429725][ T4985] hub_event+0x30a3/0x4a60 [ 113.434163][ T4985] process_one_work+0xa23/0x1940 [ 113.439105][ T4985] worker_thread+0x5ef/0xe50 [ 113.443713][ T4985] kthread+0x370/0x450 [ 113.447804][ T4985] ret_from_fork+0x72b/0xd50 [ 113.452408][ T4985] ret_from_fork_asm+0x1a/0x30 [ 113.457190][ T4985] [ 113.459503][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 113.459503][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 113.473554][ T4985] The buggy address is located 1885 bytes inside of [ 113.473554][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 113.487532][ T4985] [ 113.489854][ T4985] The buggy address belongs to the physical page: [ 113.496251][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 113.505135][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 113.513644][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 113.521183][ T4985] page_type: f5(slab) [ 113.525163][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 113.533745][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 113.542346][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 113.551034][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 113.559701][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 113.568384][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 113.577041][ T4985] page dumped because: kasan: bad access detected [ 113.583435][ T4985] page_owner tracks the page as allocated [ 113.589140][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 113.610599][ T4985] post_alloc_hook+0xfd/0x120 [ 113.615404][ T4985] get_page_from_freelist+0xf48/0x3530 [ 113.620972][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 113.626979][ T4985] new_slab+0xa2/0x640 [ 113.631079][ T4985] refill_objects+0xe3/0x410 [ 113.635680][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 113.641226][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 113.646612][ T4985] rtnl_newlink+0x126/0x2380 [ 113.651385][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 113.656372][ T4985] netlink_rcv_skb+0x159/0x420 [ 113.661152][ T4985] netlink_unicast+0x585/0x850 [ 113.666176][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 113.671312][ T4985] __sys_sendto+0x48b/0x4e0 [ 113.675832][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 113.680598][ T4985] do_syscall_64+0x115/0x870 [ 113.685203][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.691101][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 113.697421][ T4985] __free_frozen_pages+0x79f/0x1090 [ 113.702666][ T4985] qlist_free_all+0x47/0xf0 [ 113.707186][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 113.712661][ T4985] __kasan_slab_alloc+0x69/0x90 [ 113.717533][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 113.723033][ T4985] do_getname+0x35/0x390 [ 113.727291][ T4985] vfs_fstatat+0xd0/0xe0 [ 113.731532][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 113.736586][ T4985] do_syscall_64+0x115/0x870 [ 113.741193][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.747092][ T4985] [ 113.749401][ T4985] Memory state around the buggy address: [ 113.755027][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.763110][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.771168][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.779228][ T4985] ^ [ 113.786174][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.794264][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 113.802315][ T4985] ================================================================== [ 113.835656][ T4985] ================================================================== [ 113.843756][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 113.850704][ T4985] Read of size 1 at addr ffff8880264bb75e by task udevd/4985 [ 113.858085][ T4985] [ 113.860401][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 113.860441][ T4985] Tainted: [B]=BAD_PAGE [ 113.860451][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 113.860472][ T4985] Call Trace: [ 113.860482][ T4985] [ 113.860492][ T4985] dump_stack_lvl+0x100/0x190 [ 113.860526][ T4985] print_report+0x13d/0x4b0 [ 113.860567][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 113.860601][ T4985] ? __virt_addr_valid+0x239/0x430 [ 113.860636][ T4985] ? string+0x471/0x4d0 [ 113.860667][ T4985] kasan_report+0xdf/0x1c0 [ 113.860697][ T4985] ? string+0x471/0x4d0 [ 113.860735][ T4985] string+0x471/0x4d0 [ 113.860767][ T4985] ? __pfx_string+0x10/0x10 [ 113.860807][ T4985] vsnprintf+0x422/0x1300 [ 113.860847][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 113.860882][ T4985] ? ksys_read+0x12a/0x250 [ 113.860916][ T4985] ? do_syscall_64+0x115/0x870 [ 113.860953][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.860986][ T4985] add_uevent_var+0x183/0x3a0 [ 113.861016][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 113.861051][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 113.861080][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 113.861107][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 113.861134][ T4985] dev_uevent+0x2f1/0x870 [ 113.861161][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 113.861186][ T4985] ? kasan_save_track+0x14/0x30 [ 113.861229][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 113.861263][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 113.861306][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 113.861340][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 113.861382][ T4985] ? uevent_show+0x166/0x3a0 [ 113.861419][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 113.861454][ T4985] uevent_show+0x1ca/0x3a0 [ 113.861493][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 113.861528][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 113.861562][ T4985] dev_attr_show+0x52/0xa0 [ 113.861606][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 113.861650][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 113.861689][ T4985] seq_read_iter+0x32f/0x1270 [ 113.861734][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 113.861765][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 113.861799][ T4985] ? rw_verify_area+0xce/0x6d0 [ 113.861829][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 113.861862][ T4985] vfs_read+0x82e/0xb40 [ 113.861897][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 113.861933][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 113.861988][ T4985] ksys_read+0x12a/0x250 [ 113.862022][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 113.862058][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 113.862095][ T4985] do_syscall_64+0x115/0x870 [ 113.862135][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.862164][ T4985] RIP: 0033:0x7f8fd12a7407 [ 113.862186][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 113.862213][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 113.862240][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 113.862259][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 113.862276][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 113.862294][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 113.862311][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 113.862338][ T4985] [ 113.862348][ T4985] [ 114.199394][ T4985] Allocated by task 186: [ 114.203631][ T4985] kasan_save_stack+0x30/0x50 [ 114.208343][ T4985] kasan_save_track+0x14/0x30 [ 114.213048][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 114.217697][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 114.223077][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 114.228103][ T4985] usb_probe_interface+0x303/0x8f0 [ 114.233226][ T4985] really_probe+0x241/0xa60 [ 114.237765][ T4985] __driver_probe_device+0x20e/0x450 [ 114.243057][ T4985] driver_probe_device+0x4a/0x140 [ 114.248108][ T4985] __device_attach_driver+0x1df/0x320 [ 114.253582][ T4985] bus_for_each_drv+0x159/0x1e0 [ 114.258448][ T4985] __device_attach+0x1e4/0x4d0 [ 114.263231][ T4985] device_initial_probe+0xaf/0xd0 [ 114.268269][ T4985] bus_probe_device+0x64/0x160 [ 114.273031][ T4985] device_add+0x121d/0x1970 [ 114.277566][ T4985] usb_set_configuration+0xd97/0x1c60 [ 114.282996][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 114.288375][ T4985] usb_probe_device+0xef/0x400 [ 114.293152][ T4985] really_probe+0x241/0xa60 [ 114.297696][ T4985] __driver_probe_device+0x20e/0x450 [ 114.303020][ T4985] driver_probe_device+0x4a/0x140 [ 114.308070][ T4985] __device_attach_driver+0x1df/0x320 [ 114.313451][ T4985] bus_for_each_drv+0x159/0x1e0 [ 114.318320][ T4985] __device_attach+0x1e4/0x4d0 [ 114.323096][ T4985] device_initial_probe+0xaf/0xd0 [ 114.328129][ T4985] bus_probe_device+0x64/0x160 [ 114.332891][ T4985] device_add+0x121d/0x1970 [ 114.337433][ T4985] usb_new_device.cold+0x685/0x115c [ 114.342639][ T4985] hub_event+0x30a3/0x4a60 [ 114.347061][ T4985] process_one_work+0xa23/0x1940 [ 114.351992][ T4985] worker_thread+0x5ef/0xe50 [ 114.356588][ T4985] kthread+0x370/0x450 [ 114.360668][ T4985] ret_from_fork+0x72b/0xd50 [ 114.365278][ T4985] ret_from_fork_asm+0x1a/0x30 [ 114.370066][ T4985] [ 114.372388][ T4985] Freed by task 186: [ 114.376273][ T4985] kasan_save_stack+0x30/0x50 [ 114.380964][ T4985] kasan_save_track+0x14/0x30 [ 114.385649][ T4985] kasan_save_free_info+0x3b/0x70 [ 114.390679][ T4985] __kasan_slab_free+0x5f/0x80 [ 114.395433][ T4985] kfree+0x22b/0x6c0 [ 114.399327][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 114.404433][ T4985] usb_probe_interface+0x303/0x8f0 [ 114.409554][ T4985] really_probe+0x241/0xa60 [ 114.414065][ T4985] __driver_probe_device+0x20e/0x450 [ 114.419380][ T4985] driver_probe_device+0x4a/0x140 [ 114.424408][ T4985] __device_attach_driver+0x1df/0x320 [ 114.429785][ T4985] bus_for_each_drv+0x159/0x1e0 [ 114.434630][ T4985] __device_attach+0x1e4/0x4d0 [ 114.439398][ T4985] device_initial_probe+0xaf/0xd0 [ 114.444426][ T4985] bus_probe_device+0x64/0x160 [ 114.449188][ T4985] device_add+0x121d/0x1970 [ 114.453710][ T4985] usb_set_configuration+0xd97/0x1c60 [ 114.459094][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 114.464462][ T4985] usb_probe_device+0xef/0x400 [ 114.469318][ T4985] really_probe+0x241/0xa60 [ 114.473823][ T4985] __driver_probe_device+0x20e/0x450 [ 114.479118][ T4985] driver_probe_device+0x4a/0x140 [ 114.484145][ T4985] __device_attach_driver+0x1df/0x320 [ 114.489528][ T4985] bus_for_each_drv+0x159/0x1e0 [ 114.494378][ T4985] __device_attach+0x1e4/0x4d0 [ 114.499148][ T4985] device_initial_probe+0xaf/0xd0 [ 114.504195][ T4985] bus_probe_device+0x64/0x160 [ 114.508961][ T4985] device_add+0x121d/0x1970 [ 114.513476][ T4985] usb_new_device.cold+0x685/0x115c [ 114.518714][ T4985] hub_event+0x30a3/0x4a60 [ 114.523138][ T4985] process_one_work+0xa23/0x1940 [ 114.528155][ T4985] worker_thread+0x5ef/0xe50 [ 114.532761][ T4985] kthread+0x370/0x450 [ 114.537014][ T4985] ret_from_fork+0x72b/0xd50 [ 114.541610][ T4985] ret_from_fork_asm+0x1a/0x30 [ 114.546398][ T4985] [ 114.548708][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 114.548708][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 114.562753][ T4985] The buggy address is located 1886 bytes inside of [ 114.562753][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 114.576721][ T4985] [ 114.579040][ T4985] The buggy address belongs to the physical page: [ 114.585463][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 114.594217][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 114.602720][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 114.610272][ T4985] page_type: f5(slab) [ 114.614288][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 114.622970][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 114.631574][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 114.640265][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 114.649131][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 114.657925][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 114.666674][ T4985] page dumped because: kasan: bad access detected [ 114.673099][ T4985] page_owner tracks the page as allocated [ 114.678836][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 114.700322][ T4985] post_alloc_hook+0xfd/0x120 [ 114.705043][ T4985] get_page_from_freelist+0xf48/0x3530 [ 114.710563][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 114.716957][ T4985] new_slab+0xa2/0x640 [ 114.721138][ T4985] refill_objects+0xe3/0x410 [ 114.725769][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 114.731855][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 114.737239][ T4985] rtnl_newlink+0x126/0x2380 [ 114.741857][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 114.746814][ T4985] netlink_rcv_skb+0x159/0x420 [ 114.751645][ T4985] netlink_unicast+0x585/0x850 [ 114.756504][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 114.761293][ T4985] __sys_sendto+0x48b/0x4e0 [ 114.765814][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 114.770593][ T4985] do_syscall_64+0x115/0x870 [ 114.775198][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.781103][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 114.787514][ T4985] __free_frozen_pages+0x79f/0x1090 [ 114.792731][ T4985] qlist_free_all+0x47/0xf0 [ 114.797260][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 114.802769][ T4985] __kasan_slab_alloc+0x69/0x90 [ 114.807635][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 114.813212][ T4985] do_getname+0x35/0x390 [ 114.817477][ T4985] vfs_fstatat+0xd0/0xe0 [ 114.821821][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 114.826865][ T4985] do_syscall_64+0x115/0x870 [ 114.831472][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.837374][ T4985] [ 114.839697][ T4985] Memory state around the buggy address: [ 114.845319][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.853384][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.861441][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.869583][ T4985] ^ [ 114.876524][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.884588][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 114.892645][ T4985] ================================================================== [ 114.913736][ T4985] ================================================================== [ 114.921846][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 114.928829][ T4985] Read of size 1 at addr ffff8880264bb75f by task udevd/4985 [ 114.936217][ T4985] [ 114.938566][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 114.938633][ T4985] Tainted: [B]=BAD_PAGE [ 114.938647][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 114.938669][ T4985] Call Trace: [ 114.938682][ T4985] [ 114.938695][ T4985] dump_stack_lvl+0x100/0x190 [ 114.938742][ T4985] print_report+0x13d/0x4b0 [ 114.938797][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.938844][ T4985] ? __virt_addr_valid+0x239/0x430 [ 114.938893][ T4985] ? string+0x471/0x4d0 [ 114.938941][ T4985] kasan_report+0xdf/0x1c0 [ 114.938981][ T4985] ? string+0x471/0x4d0 [ 114.939028][ T4985] string+0x471/0x4d0 [ 114.939071][ T4985] ? __pfx_string+0x10/0x10 [ 114.939119][ T4985] vsnprintf+0x422/0x1300 [ 114.939174][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 114.939222][ T4985] ? ksys_read+0x12a/0x250 [ 114.939271][ T4985] ? do_syscall_64+0x115/0x870 [ 114.939323][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.939366][ T4985] add_uevent_var+0x183/0x3a0 [ 114.939407][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 114.939454][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 114.939493][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 114.939529][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 114.939565][ T4985] dev_uevent+0x2f1/0x870 [ 114.939602][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 114.939645][ T4985] ? kasan_save_track+0x14/0x30 [ 114.939706][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.939751][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 114.939810][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.939856][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 114.939909][ T4985] ? uevent_show+0x166/0x3a0 [ 114.939961][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 114.940009][ T4985] uevent_show+0x1ca/0x3a0 [ 114.940056][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.940104][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 114.940150][ T4985] dev_attr_show+0x52/0xa0 [ 114.940211][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 114.940271][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 114.940324][ T4985] seq_read_iter+0x32f/0x1270 [ 114.940385][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 114.940427][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.940474][ T4985] ? rw_verify_area+0xce/0x6d0 [ 114.940515][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 114.940561][ T4985] vfs_read+0x82e/0xb40 [ 114.940610][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 114.940666][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 114.940742][ T4985] ksys_read+0x12a/0x250 [ 114.940788][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 114.940837][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.940887][ T4985] do_syscall_64+0x115/0x870 [ 114.940943][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.940982][ T4985] RIP: 0033:0x7f8fd12a7407 [ 114.941010][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 114.941047][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 114.941082][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 114.941108][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 114.941131][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 114.941155][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 114.941178][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 114.941213][ T4985] [ 114.941226][ T4985] [ 115.278626][ T4985] Allocated by task 186: [ 115.282894][ T4985] kasan_save_stack+0x30/0x50 [ 115.287605][ T4985] kasan_save_track+0x14/0x30 [ 115.292311][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 115.296971][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 115.302398][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 115.307427][ T4985] usb_probe_interface+0x303/0x8f0 [ 115.312573][ T4985] really_probe+0x241/0xa60 [ 115.317203][ T4985] __driver_probe_device+0x20e/0x450 [ 115.322511][ T4985] driver_probe_device+0x4a/0x140 [ 115.327749][ T4985] __device_attach_driver+0x1df/0x320 [ 115.333143][ T4985] bus_for_each_drv+0x159/0x1e0 [ 115.338028][ T4985] __device_attach+0x1e4/0x4d0 [ 115.342813][ T4985] device_initial_probe+0xaf/0xd0 [ 115.347869][ T4985] bus_probe_device+0x64/0x160 [ 115.352650][ T4985] device_add+0x121d/0x1970 [ 115.357265][ T4985] usb_set_configuration+0xd97/0x1c60 [ 115.362655][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 115.368040][ T4985] usb_probe_device+0xef/0x400 [ 115.372825][ T4985] really_probe+0x241/0xa60 [ 115.377345][ T4985] __driver_probe_device+0x20e/0x450 [ 115.382649][ T4985] driver_probe_device+0x4a/0x140 [ 115.387690][ T4985] __device_attach_driver+0x1df/0x320 [ 115.393114][ T4985] bus_for_each_drv+0x159/0x1e0 [ 115.397972][ T4985] __device_attach+0x1e4/0x4d0 [ 115.402753][ T4985] device_initial_probe+0xaf/0xd0 [ 115.407901][ T4985] bus_probe_device+0x64/0x160 [ 115.412675][ T4985] device_add+0x121d/0x1970 [ 115.417204][ T4985] usb_new_device.cold+0x685/0x115c [ 115.422413][ T4985] hub_event+0x30a3/0x4a60 [ 115.426869][ T4985] process_one_work+0xa23/0x1940 [ 115.431829][ T4985] worker_thread+0x5ef/0xe50 [ 115.436427][ T4985] kthread+0x370/0x450 [ 115.440534][ T4985] ret_from_fork+0x72b/0xd50 [ 115.445235][ T4985] ret_from_fork_asm+0x1a/0x30 [ 115.450028][ T4985] [ 115.452475][ T4985] Freed by task 186: [ 115.456384][ T4985] kasan_save_stack+0x30/0x50 [ 115.461103][ T4985] kasan_save_track+0x14/0x30 [ 115.465810][ T4985] kasan_save_free_info+0x3b/0x70 [ 115.470855][ T4985] __kasan_slab_free+0x5f/0x80 [ 115.475712][ T4985] kfree+0x22b/0x6c0 [ 115.479622][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 115.484755][ T4985] usb_probe_interface+0x303/0x8f0 [ 115.489987][ T4985] really_probe+0x241/0xa60 [ 115.494594][ T4985] __driver_probe_device+0x20e/0x450 [ 115.499899][ T4985] driver_probe_device+0x4a/0x140 [ 115.504942][ T4985] __device_attach_driver+0x1df/0x320 [ 115.510339][ T4985] bus_for_each_drv+0x159/0x1e0 [ 115.515198][ T4985] __device_attach+0x1e4/0x4d0 [ 115.519979][ T4985] device_initial_probe+0xaf/0xd0 [ 115.525022][ T4985] bus_probe_device+0x64/0x160 [ 115.529799][ T4985] device_add+0x121d/0x1970 [ 115.534330][ T4985] usb_set_configuration+0xd97/0x1c60 [ 115.539722][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 115.545222][ T4985] usb_probe_device+0xef/0x400 [ 115.550008][ T4985] really_probe+0x241/0xa60 [ 115.554531][ T4985] __driver_probe_device+0x20e/0x450 [ 115.559846][ T4985] driver_probe_device+0x4a/0x140 [ 115.564892][ T4985] __device_attach_driver+0x1df/0x320 [ 115.570284][ T4985] bus_for_each_drv+0x159/0x1e0 [ 115.575145][ T4985] __device_attach+0x1e4/0x4d0 [ 115.580021][ T4985] device_initial_probe+0xaf/0xd0 [ 115.585109][ T4985] bus_probe_device+0x64/0x160 [ 115.589899][ T4985] device_add+0x121d/0x1970 [ 115.594425][ T4985] usb_new_device.cold+0x685/0x115c [ 115.599639][ T4985] hub_event+0x30a3/0x4a60 [ 115.604076][ T4985] process_one_work+0xa23/0x1940 [ 115.609020][ T4985] worker_thread+0x5ef/0xe50 [ 115.613614][ T4985] kthread+0x370/0x450 [ 115.617707][ T4985] ret_from_fork+0x72b/0xd50 [ 115.622367][ T4985] ret_from_fork_asm+0x1a/0x30 [ 115.627217][ T4985] [ 115.629622][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 115.629622][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 115.643676][ T4985] The buggy address is located 1887 bytes inside of [ 115.643676][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 115.657664][ T4985] [ 115.660011][ T4985] The buggy address belongs to the physical page: [ 115.666413][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 115.675178][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 115.683678][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 115.691222][ T4985] page_type: f5(slab) [ 115.695203][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 115.703791][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 115.712404][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 115.721129][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 115.729819][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 115.738561][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 115.747317][ T4985] page dumped because: kasan: bad access detected [ 115.753723][ T4985] page_owner tracks the page as allocated [ 115.759429][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 115.781032][ T4985] post_alloc_hook+0xfd/0x120 [ 115.785746][ T4985] get_page_from_freelist+0xf48/0x3530 [ 115.791234][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 115.797331][ T4985] new_slab+0xa2/0x640 [ 115.801423][ T4985] refill_objects+0xe3/0x410 [ 115.806040][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 115.811611][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 115.817021][ T4985] rtnl_newlink+0x126/0x2380 [ 115.821647][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 115.826609][ T4985] netlink_rcv_skb+0x159/0x420 [ 115.831483][ T4985] netlink_unicast+0x585/0x850 [ 115.836258][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 115.841081][ T4985] __sys_sendto+0x48b/0x4e0 [ 115.845601][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 115.850386][ T4985] do_syscall_64+0x115/0x870 [ 115.855086][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.861083][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 115.867404][ T4985] __free_frozen_pages+0x79f/0x1090 [ 115.872617][ T4985] qlist_free_all+0x47/0xf0 [ 115.877142][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 115.882626][ T4985] __kasan_slab_alloc+0x69/0x90 [ 115.887570][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 115.893058][ T4985] do_getname+0x35/0x390 [ 115.897325][ T4985] vfs_fstatat+0xd0/0xe0 [ 115.901568][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 115.906683][ T4985] do_syscall_64+0x115/0x870 [ 115.911380][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.917286][ T4985] [ 115.919600][ T4985] Memory state around the buggy address: [ 115.925220][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.933317][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.941377][ T4985] >ffff8880264bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.949526][ T4985] ^ [ 115.956555][ T4985] ffff8880264bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.964908][ T4985] ffff8880264bb800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 115.972967][ T4985] ================================================================== [ 115.990158][ T4985] ================================================================== [ 115.998238][ T4985] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 116.005201][ T4985] Read of size 1 at addr ffff8880264bb760 by task udevd/4985 [ 116.012625][ T4985] [ 116.014955][ T4985] CPU: 0 UID: 0 PID: 4985 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 116.015005][ T4985] Tainted: [B]=BAD_PAGE [ 116.015017][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 116.015038][ T4985] Call Trace: [ 116.015050][ T4985] [ 116.015063][ T4985] dump_stack_lvl+0x100/0x190 [ 116.015106][ T4985] print_report+0x13d/0x4b0 [ 116.015158][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.015200][ T4985] ? __virt_addr_valid+0x239/0x430 [ 116.015244][ T4985] ? string+0x471/0x4d0 [ 116.015283][ T4985] kasan_report+0xdf/0x1c0 [ 116.015322][ T4985] ? string+0x471/0x4d0 [ 116.015364][ T4985] string+0x471/0x4d0 [ 116.015404][ T4985] ? __pfx_string+0x10/0x10 [ 116.015448][ T4985] vsnprintf+0x422/0x1300 [ 116.015498][ T4985] ? __pfx_vsnprintf+0x10/0x10 [ 116.015542][ T4985] ? ksys_read+0x12a/0x250 [ 116.015584][ T4985] ? do_syscall_64+0x115/0x870 [ 116.015631][ T4985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.015671][ T4985] add_uevent_var+0x183/0x3a0 [ 116.015709][ T4985] ? __pfx_add_uevent_var+0x10/0x10 [ 116.015752][ T4985] ? rc_dev_uevent+0x12d/0x1c0 [ 116.015787][ T4985] ? __pfx_rc_dev_uevent+0x10/0x10 [ 116.015820][ T4985] rc_dev_uevent+0x17d/0x1c0 [ 116.015854][ T4985] dev_uevent+0x2f1/0x870 [ 116.015888][ T4985] ? __pfx_dev_uevent+0x10/0x10 [ 116.015918][ T4985] ? kasan_save_track+0x14/0x30 [ 116.015977][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.016019][ T4985] ? __kasan_kmalloc+0xaa/0xb0 [ 116.016073][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.016115][ T4985] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 116.016163][ T4985] ? uevent_show+0x166/0x3a0 [ 116.016209][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 116.016252][ T4985] uevent_show+0x1ca/0x3a0 [ 116.016295][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.016339][ T4985] ? __pfx_uevent_show+0x10/0x10 [ 116.016382][ T4985] dev_attr_show+0x52/0xa0 [ 116.016438][ T4985] ? __pfx_dev_attr_show+0x10/0x10 [ 116.016493][ T4985] sysfs_kf_seq_show+0x217/0x3f0 [ 116.016542][ T4985] seq_read_iter+0x32f/0x1270 [ 116.016599][ T4985] kernfs_fop_read_iter+0x46c/0x610 [ 116.016637][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.016679][ T4985] ? rw_verify_area+0xce/0x6d0 [ 116.016716][ T4985] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 116.016757][ T4985] vfs_read+0x82e/0xb40 [ 116.016801][ T4985] ? __pfx_vfs_read+0x10/0x10 [ 116.016846][ T4985] ? __pfx___do_sys_newfstat+0x10/0x10 [ 116.016914][ T4985] ksys_read+0x12a/0x250 [ 116.016978][ T4985] ? __pfx_ksys_read+0x10/0x10 [ 116.017023][ T4985] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.017069][ T4985] do_syscall_64+0x115/0x870 [ 116.017118][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.017154][ T4985] RIP: 0033:0x7f8fd12a7407 [ 116.017181][ T4985] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 116.017214][ T4985] RSP: 002b:00007ffed551e4e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 116.017247][ T4985] RAX: ffffffffffffffda RBX: 00007f8fd11bb880 RCX: 00007f8fd12a7407 [ 116.017270][ T4985] RDX: 0000000000001000 RSI: 000055d4fa2a3410 RDI: 000000000000000c [ 116.017292][ T4985] RBP: 00007f8fd13efff0 R08: 0000000000000000 R09: 0000000000000000 [ 116.017313][ T4985] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 116.017335][ T4985] R13: 00007f8fd13efea0 R14: 0000000000000000 R15: 000055d4fa28ca80 [ 116.017368][ T4985] [ 116.017379][ T4985] [ 116.355123][ T4985] Allocated by task 186: [ 116.359358][ T4985] kasan_save_stack+0x30/0x50 [ 116.364111][ T4985] kasan_save_track+0x14/0x30 [ 116.368836][ T4985] __kasan_kmalloc+0xaa/0xb0 [ 116.373540][ T4985] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 116.379283][ T4985] redrat3_dev_probe+0x326/0x2b50 [ 116.384321][ T4985] usb_probe_interface+0x303/0x8f0 [ 116.389481][ T4985] really_probe+0x241/0xa60 [ 116.394031][ T4985] __driver_probe_device+0x20e/0x450 [ 116.399377][ T4985] driver_probe_device+0x4a/0x140 [ 116.404431][ T4985] __device_attach_driver+0x1df/0x320 [ 116.409829][ T4985] bus_for_each_drv+0x159/0x1e0 [ 116.414727][ T4985] __device_attach+0x1e4/0x4d0 [ 116.419516][ T4985] device_initial_probe+0xaf/0xd0 [ 116.424571][ T4985] bus_probe_device+0x64/0x160 [ 116.429351][ T4985] device_add+0x121d/0x1970 [ 116.433881][ T4985] usb_set_configuration+0xd97/0x1c60 [ 116.439310][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 116.444697][ T4985] usb_probe_device+0xef/0x400 [ 116.449487][ T4985] really_probe+0x241/0xa60 [ 116.454010][ T4985] __driver_probe_device+0x20e/0x450 [ 116.459314][ T4985] driver_probe_device+0x4a/0x140 [ 116.464360][ T4985] __device_attach_driver+0x1df/0x320 [ 116.469756][ T4985] bus_for_each_drv+0x159/0x1e0 [ 116.474614][ T4985] __device_attach+0x1e4/0x4d0 [ 116.479398][ T4985] device_initial_probe+0xaf/0xd0 [ 116.484449][ T4985] bus_probe_device+0x64/0x160 [ 116.489227][ T4985] device_add+0x121d/0x1970 [ 116.493759][ T4985] usb_new_device.cold+0x685/0x115c [ 116.498975][ T4985] hub_event+0x30a3/0x4a60 [ 116.503409][ T4985] process_one_work+0xa23/0x1940 [ 116.508357][ T4985] worker_thread+0x5ef/0xe50 [ 116.513300][ T4985] kthread+0x370/0x450 [ 116.517392][ T4985] ret_from_fork+0x72b/0xd50 [ 116.521996][ T4985] ret_from_fork_asm+0x1a/0x30 [ 116.526809][ T4985] [ 116.529123][ T4985] Freed by task 186: [ 116.533004][ T4985] kasan_save_stack+0x30/0x50 [ 116.537716][ T4985] kasan_save_track+0x14/0x30 [ 116.542420][ T4985] kasan_save_free_info+0x3b/0x70 [ 116.547463][ T4985] __kasan_slab_free+0x5f/0x80 [ 116.552235][ T4985] kfree+0x22b/0x6c0 [ 116.556143][ T4985] redrat3_dev_probe+0x107a/0x2b50 [ 116.561258][ T4985] usb_probe_interface+0x303/0x8f0 [ 116.566395][ T4985] really_probe+0x241/0xa60 [ 116.570945][ T4985] __driver_probe_device+0x20e/0x450 [ 116.576252][ T4985] driver_probe_device+0x4a/0x140 [ 116.581301][ T4985] __device_attach_driver+0x1df/0x320 [ 116.586692][ T4985] bus_for_each_drv+0x159/0x1e0 [ 116.591549][ T4985] __device_attach+0x1e4/0x4d0 [ 116.596334][ T4985] device_initial_probe+0xaf/0xd0 [ 116.601379][ T4985] bus_probe_device+0x64/0x160 [ 116.606158][ T4985] device_add+0x121d/0x1970 [ 116.610701][ T4985] usb_set_configuration+0xd97/0x1c60 [ 116.616114][ T4985] usb_generic_driver_probe+0xa1/0xe0 [ 116.621507][ T4985] usb_probe_device+0xef/0x400 [ 116.626299][ T4985] really_probe+0x241/0xa60 [ 116.630825][ T4985] __driver_probe_device+0x20e/0x450 [ 116.636138][ T4985] driver_probe_device+0x4a/0x140 [ 116.641189][ T4985] __device_attach_driver+0x1df/0x320 [ 116.646581][ T4985] bus_for_each_drv+0x159/0x1e0 [ 116.651442][ T4985] __device_attach+0x1e4/0x4d0 [ 116.656224][ T4985] device_initial_probe+0xaf/0xd0 [ 116.661272][ T4985] bus_probe_device+0x64/0x160 [ 116.666057][ T4985] device_add+0x121d/0x1970 [ 116.670591][ T4985] usb_new_device.cold+0x685/0x115c [ 116.675805][ T4985] hub_event+0x30a3/0x4a60 [ 116.680242][ T4985] process_one_work+0xa23/0x1940 [ 116.685187][ T4985] worker_thread+0x5ef/0xe50 [ 116.689784][ T4985] kthread+0x370/0x450 [ 116.693877][ T4985] ret_from_fork+0x72b/0xd50 [ 116.698485][ T4985] ret_from_fork_asm+0x1a/0x30 [ 116.703269][ T4985] [ 116.705588][ T4985] The buggy address belongs to the object at ffff8880264bb000 [ 116.705588][ T4985] which belongs to the cache kmalloc-2k of size 2048 [ 116.719645][ T4985] The buggy address is located 1888 bytes inside of [ 116.719645][ T4985] freed 2048-byte region [ffff8880264bb000, ffff8880264bb800) [ 116.733629][ T4985] [ 116.735955][ T4985] The buggy address belongs to the physical page: [ 116.742356][ T4985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x264b8 [ 116.751120][ T4985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 116.759659][ T4985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 116.767213][ T4985] page_type: f5(slab) [ 116.771202][ T4985] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 116.779795][ T4985] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 116.788473][ T4985] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122 [ 116.797151][ T4985] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 116.805831][ T4985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 116.814508][ T4985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 116.823179][ T4985] page dumped because: kasan: bad access detected [ 116.829605][ T4985] page_owner tracks the page as allocated [ 116.835326][ T4985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5631, tgid 5631 (syz-executor), ts 104598248564, free_ts 58977293323 [ 116.856806][ T4985] post_alloc_hook+0xfd/0x120 [ 116.861771][ T4985] get_page_from_freelist+0xf48/0x3530 [ 116.867264][ T4985] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 116.873195][ T4985] new_slab+0xa2/0x640 [ 116.877293][ T4985] refill_objects+0xe3/0x410 [ 116.881915][ T4985] __pcs_replace_empty_main+0x376/0x680 [ 116.887478][ T4985] __kmalloc_cache_noprof+0x479/0x6c0 [ 116.892940][ T4985] rtnl_newlink+0x126/0x2380 [ 116.897552][ T4985] rtnetlink_rcv_msg+0x95e/0xe90 [ 116.902539][ T4985] netlink_rcv_skb+0x159/0x420 [ 116.907315][ T4985] netlink_unicast+0x585/0x850 [ 116.912087][ T4985] netlink_sendmsg+0x8b0/0xda0 [ 116.916861][ T4985] __sys_sendto+0x48b/0x4e0 [ 116.921471][ T4985] __x64_sys_sendto+0xe0/0x1c0 [ 116.926250][ T4985] do_syscall_64+0x115/0x870 [ 116.930856][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.936756][ T4985] page last free pid 5302 tgid 5302 stack trace: [ 116.943094][ T4985] __free_frozen_pages+0x79f/0x1090 [ 116.948306][ T4985] qlist_free_all+0x47/0xf0 [ 116.952833][ T4985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 116.958323][ T4985] __kasan_slab_alloc+0x69/0x90 [ 116.963181][ T4985] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 116.968666][ T4985] do_getname+0x35/0x390 [ 116.972914][ T4985] vfs_fstatat+0xd0/0xe0 [ 116.977160][ T4985] __do_sys_newfstatat+0x9d/0x120 [ 116.982193][ T4985] do_syscall_64+0x115/0x870 [ 116.986804][ T4985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.992795][ T4985] [ 116.995108][ T4985] Memory state around the buggy address: [ 117.000738][ T4985] ffff8880264bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 117.008829][ T4985] ffff8880264bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb