Warning: Permanently added '10.128.1.17' (ED25519) to the list of known hosts.
2026/10/10 02:38:18 parsed 1 programs
2026/10/10 02:38:18 serving rpc on tcp://33775
[ 91.944086][ T9] cfg80211: failed to load regulatory.db
[ 92.226253][ T5632] cgroup: Unknown subsys name 'net'
[ 92.322938][ T5632] cgroup: Unknown subsys name 'cpuset'
[ 92.326358][ T5632] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 93.950414][ T5632] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 97.247741][ T5645] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 97.267097][ T5645] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 97.280250][ T5645] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 97.281248][ T5645] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 97.291113][ T5645] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 99.419586][ T5679] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.420284][ T5679] bridge0: port 1(bridge_slave_0) entered disabled state
[ 99.420422][ T5679] bridge_slave_0: entered allmulticast mode
[ 99.421865][ T5679] bridge_slave_0: entered promiscuous mode
[ 99.434456][ T5679] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.435114][ T5679] bridge0: port 2(bridge_slave_1) entered disabled state
[ 99.435503][ T5679] bridge_slave_1: entered allmulticast mode
[ 99.440562][ T5679] bridge_slave_1: entered promiscuous mode
[ 99.493297][ T5679] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 99.496321][ T5679] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 99.533238][ T5679] team0: Port device team_slave_0 added
[ 99.535383][ T5679] team0: Port device team_slave_1 added
[ 99.565459][ T5679] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 99.565474][ T5679] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 99.565492][ T5679] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 99.567460][ T5679] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 99.567475][ T5679] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 99.567500][ T5679] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 99.676327][ T5679] hsr_slave_0: entered promiscuous mode
[ 99.677246][ T5679] hsr_slave_1: entered promiscuous mode
[ 99.845537][ T5679] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 99.858925][ T5679] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 99.860255][ T5679] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 99.864791][ T5679] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 99.865764][ T5679] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 99.890954][ T5679] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 99.894669][ T5679] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 99.916033][ T5679] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 100.013273][ T5679] 8021q: adding VLAN 0 to HW filter on device bond0
[ 100.040020][ T5679] 8021q: adding VLAN 0 to HW filter on device team0
[ 100.046552][ T3002] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.046654][ T3002] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 100.076959][ T3002] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.077048][ T3002] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 100.445131][ T5679] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 100.501008][ T5679] veth0_vlan: entered promiscuous mode
[ 100.513812][ T5679] veth1_vlan: entered promiscuous mode
[ 100.547226][ T5679] veth0_macvtap: entered promiscuous mode
[ 100.559449][ T5679] veth1_macvtap: entered promiscuous mode
[ 100.580028][ T5679] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 100.597905][ T5679] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 100.651128][ T271] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.651173][ T271] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.651207][ T271] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.651239][ T271] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.796704][ T271] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.885511][ T271] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.936289][ T271] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 101.012256][ T271] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 101.444886][ T5731] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 101.447621][ T5731] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 101.467005][ T5731] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 101.476116][ T5731] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 101.476940][ T5731] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 101.989300][ T3010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 101.989324][ T3010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 102.037849][ T3010] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.037873][ T3010] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/10/10 02:38:32 executed programs: 0
[ 102.513761][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 102.515332][ T53] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 102.516215][ T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 102.517581][ T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 102.536960][ T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 103.023180][ T271] bridge_slave_1: left allmulticast mode
[ 103.023214][ T271] bridge_slave_1: left promiscuous mode
[ 103.024154][ T271] bridge0: port 2(bridge_slave_1) entered disabled state
[ 103.051705][ T271] bridge_slave_0: left allmulticast mode
[ 103.051734][ T271] bridge_slave_0: left promiscuous mode
[ 103.052292][ T271] bridge0: port 1(bridge_slave_0) entered disabled state
[ 103.207966][ T271] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 103.225251][ T271] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 103.227142][ T271] bond0 (unregistering): Released all slaves
[ 103.396202][ T271] hsr_slave_0: left promiscuous mode
[ 103.397012][ T271] hsr_slave_1: left promiscuous mode
[ 103.409685][ T271] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 103.409753][ T271] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 103.429680][ T271] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 103.429704][ T271] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 103.455399][ T271] veth1_macvtap: left promiscuous mode
[ 103.455497][ T271] veth0_macvtap: left promiscuous mode
[ 103.455616][ T271] veth1_vlan: left promiscuous mode
[ 103.455706][ T271] veth0_vlan: left promiscuous mode
[ 103.787850][ T271] team0 (unregistering): Port device team_slave_1 removed
[ 103.817344][ T271] team0 (unregistering): Port device team_slave_0 removed
[ 103.979622][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1
[ 103.980098][ T5751] bridge0: port 1(bridge_slave_0) entered blocking state
[ 103.980363][ T5751] bridge0: port 1(bridge_slave_0) entered disabled state
[ 103.980494][ T5751] bridge_slave_0: entered allmulticast mode
[ 103.982351][ T5751] bridge_slave_0: entered promiscuous mode
[ 103.990299][ T5751] bridge0: port 2(bridge_slave_1) entered blocking state
[ 103.990423][ T5751] bridge0: port 2(bridge_slave_1) entered disabled state
[ 103.990533][ T5751] bridge_slave_1: entered allmulticast mode
[ 103.992589][ T5751] bridge_slave_1: entered promiscuous mode
[ 104.084350][ T5751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 104.087938][ T5751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 104.143496][ T5751] team0: Port device team_slave_0 added
[ 104.146440][ T5751] team0: Port device team_slave_1 added
[ 104.192462][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 104.192480][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 104.192505][ T5751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 104.194703][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 104.194719][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 104.194745][ T5751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 104.365894][ T5751] hsr_slave_0: entered promiscuous mode
[ 104.367249][ T5751] hsr_slave_1: entered promiscuous mode
[ 104.579955][ T53] Bluetooth: hci0: command tx timeout
[ 104.949972][ T5283] 8021q: adding VLAN 0 to HW filter on device eth2
[ 105.441575][ T5751] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 105.446845][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 105.470783][ T5751] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 105.485973][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 105.496490][ T5751] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 105.513583][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 105.516884][ T5751] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 105.536108][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 105.744074][ T5751] 8021q: adding VLAN 0 to HW filter on device bond0
[ 105.771486][ T5751] 8021q: adding VLAN 0 to HW filter on device team0
[ 105.784879][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.785193][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 105.811654][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.811763][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 106.379401][ T5751] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 106.427092][ T5751] veth0_vlan: entered promiscuous mode
[ 106.443645][ T5751] veth1_vlan: entered promiscuous mode
[ 106.475691][ T5751] veth0_macvtap: entered promiscuous mode
[ 106.484676][ T5751] veth1_macvtap: entered promiscuous mode
[ 106.505240][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 106.521997][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 106.580372][ T3002] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.581342][ T3002] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.622390][ T271] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.622415][ T271] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.658481][ T53] Bluetooth: hci0: command tx timeout
[ 106.667325][ T271] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.667347][ T271] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.698359][ T3035] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.698405][ T3035] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.998784][ T925] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 107.148868][ T925] usb 1-1: Using ep0 maxpacket: 32
[ 107.151522][ T925] usb 1-1: unable to get BOS descriptor or descriptor too short
[ 107.151632][ T925] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 107.153259][ T925] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 107.153283][ T925] usb 1-1: config 3 has an invalid interface number: 25 but max is 1
[ 107.153302][ T925] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 107.153320][ T925] usb 1-1: config 3 has no interface number 0
[ 107.153335][ T925] usb 1-1: config 3 has no interface number 1
[ 107.153469][ T925] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 107.153484][ T925] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 107.153501][ T925] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 107.153526][ T925] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 107.153545][ T925] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 107.153563][ T925] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 107.153581][ T925] usb 1-1: config 3 interface 223 has no altsetting 1
[ 107.153593][ T925] usb 1-1: config 3 interface 25 has no altsetting 0
[ 107.155702][ T925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 107.155726][ T925] usb 1-1: Product: syz
[ 107.155740][ T925] usb 1-1: Manufacturer: syz
[ 107.155754][ T925] usb 1-1: SerialNumber: syz
[ 107.496002][ T925] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 107.526860][ T925] usb 1-1: USB disconnect, device number 2
[ 107.690464][ T925]
[ 107.692856][ T925] =========================
[ 107.697401][ T925] WARNING: held lock freed!
[ 107.701949][ T925] syzkaller #0 Not tainted
[ 107.706389][ T925] -------------------------
[ 107.710914][ T925] kworker/1:2/925 is freeing memory ffff88802ff0c000-ffff88802ff0c7ff, with a lock still held there!
[ 107.721787][ T925] ffff88802ff0c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 107.731944][ T925] locks held by kworker/1:2/925: 5, last CPU#1:
[ 107.738204][ T925] #0: ffff888021e94d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 107.749543][ T925] #1: ffffc90004adfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 107.761433][ T925] #2: ffff88802ab031d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 107.770377][ T925] #3: ffff88807a0511d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 107.779548][ T925] #4: ffff88802ff0c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 107.790112][ T925]
[ 107.790112][ T925] stack backtrace:
[ 107.796056][ T925] CPU: 1 UID: 0 PID: 925 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 107.805366][ T925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 107.815457][ T925] Workqueue: usb_hub_wq hub_event
[ 107.820542][ T925] Call Trace:
[ 107.823840][ T925]
[ 107.826791][ T925] dump_stack_lvl+0xe8/0x150
[ 107.831422][ T925] debug_check_no_locks_freed+0x149/0x170
[ 107.837182][ T925] kfree+0x12b/0x650
[ 107.841102][ T925] ? device_release+0xc4/0x1f0
[ 107.845890][ T925] ? __pfx_usb_release_interface+0x10/0x10
[ 107.851736][ T925] device_release+0xc4/0x1f0
[ 107.856361][ T925] kobject_put+0x222/0x550
[ 107.860817][ T925] v4l2_device_disconnect+0x79/0xd0
[ 107.866046][ T925] usbtv_video_free+0x25/0x30
[ 107.870756][ T925] usbtv_disconnect+0x5c/0xa0
[ 107.875455][ T925] usb_unbind_interface+0x295/0x9f0
[ 107.880689][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 107.886469][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 107.892222][ T925] ? __pfx_usb_unbind_interface+0x10/0x10
[ 107.897974][ T925] device_release_driver_internal+0x4f5/0x880
[ 107.904085][ T925] bus_remove_device+0x444/0x560
[ 107.909062][ T925] ? __pfx_bus_remove_device+0x10/0x10
[ 107.914552][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 107.920313][ T925] device_del+0x524/0x8f0
[ 107.924688][ T925] ? __pfx_device_del+0x10/0x10
[ 107.929579][ T925] ? __pfx___mutex_lock+0x10/0x10
[ 107.934636][ T925] usb_disable_device+0x3d4/0x8d0
[ 107.939719][ T925] usb_disconnect+0x346/0x9a0
[ 107.944439][ T925] hub_event+0x1bbb/0x4d30
[ 107.948918][ T925] ? do_raw_spin_unlock+0xf5/0x200
[ 107.954079][ T925] ? register_lock_class+0x31/0x2e0
[ 107.959320][ T925] ? __pfx_hub_event+0x10/0x10
[ 107.964115][ T925] ? rcu_is_watching+0x16/0xb0
[ 107.968910][ T925] ? process_scheduled_works+0x97a/0x1630
[ 107.974660][ T925] process_scheduled_works+0xc3d/0x1630
[ 107.980246][ T925] ? __pfx_process_scheduled_works+0x10/0x10
[ 107.986273][ T925] ? assign_work+0x3cf/0x5d0
[ 107.990904][ T925] worker_thread+0xa47/0xfb0
[ 107.995547][ T925] ? __kthread_parkme+0x71/0x1f0
[ 108.000527][ T925] kthread+0x38b/0x480
[ 108.004630][ T925] ? __pfx_worker_thread+0x10/0x10
[ 108.009815][ T925] ? __pfx_kthread+0x10/0x10
[ 108.014452][ T925] ret_from_fork+0x514/0xb70
[ 108.019070][ T925] ? __pfx_ret_from_fork+0x10/0x10
[ 108.024199][ T925] ? __switch_to+0xc89/0x1420
[ 108.028904][ T925] ? __pfx_kthread+0x10/0x10
[ 108.033528][ T925] ret_from_fork_asm+0x1a/0x30
[ 108.038329][ T925]
[ 108.057686][ T925] ==================================================================
[ 108.057702][ T925] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 108.057744][ T925] Read of size 8 at addr ffff88802ff0c008 by task kworker/1:2/925
[ 108.057761][ T925]
[ 108.057772][ T925] CPU: 1 UI
** replaying previous printk message **
[ 108.057772][ T925] CPU: 1 UID: 0 PID: 925 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 108.057795][ T925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 108.057809][ T925] Workqueue: usb_hub_wq hub_event
[ 108.057841][ T925] Call Trace:
[ 108.057850][ T925]
[ 108.057859][ T925] dump_stack_lvl+0xe8/0x150
[ 108.057892][ T925] print_address_description+0x55/0x1e0
[ 108.057923][ T925] ? usb_unbind_interface+0x2c2/0x9f0
[ 108.057955][ T925] print_report+0x58/0x70
[ 108.057983][ T925] kasan_report+0x117/0x150
[ 108.058017][ T925] ? usb_unbind_interface+0x2c2/0x9f0
[ 108.058054][ T925] usb_unbind_interface+0x2c2/0x9f0
[ 108.058087][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 108.058119][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 108.058149][ T925] ? __pfx_usb_unbind_interface+0x10/0x10
[ 108.058183][ T925] device_release_driver_internal+0x4f5/0x880
[ 108.058220][ T925] bus_remove_device+0x444/0x560
[ 108.058248][ T925] ? __pfx_bus_remove_device+0x10/0x10
[ 108.058274][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 108.058315][ T925] device_del+0x524/0x8f0
[ 108.058348][ T925] ? __pfx_device_del+0x10/0x10
[ 108.058375][ T925] ? __pfx___mutex_lock+0x10/0x10
[ 108.058405][ T925] usb_disable_device+0x3d4/0x8d0
[ 108.058440][ T925] usb_disconnect+0x346/0x9a0
[ 108.058471][ T925] hub_event+0x1bbb/0x4d30
[ 108.058502][ T925] ? do_raw_spin_unlock+0xf5/0x200
[ 108.058540][ T925] ? register_lock_class+0x31/0x2e0
[ 108.058579][ T925] ? __pfx_hub_event+0x10/0x10
[ 108.058614][ T925] ? rcu_is_watching+0x16/0xb0
[ 108.058650][ T925] ? process_scheduled_works+0x97a/0x1630
[ 108.058680][ T925] process_scheduled_works+0xc3d/0x1630
[ 108.058724][ T925] ? __pfx_process_scheduled_works+0x10/0x10
[ 108.058756][ T925] ? assign_work+0x3cf/0x5d0
[ 108.058787][ T925] worker_thread+0xa47/0xfb0
[ 108.058823][ T925] ? __kthread_parkme+0x71/0x1f0
[ 108.058860][ T925] kthread+0x38b/0x480
[ 108.058882][ T925] ? __pfx_worker_thread+0x10/0x10
[ 108.058910][ T925] ? __pfx_kthread+0x10/0x10
[ 108.058932][ T925] ret_from_fork+0x514/0xb70
[ 108.058955][ T925] ? __pfx_ret_from_fork+0x10/0x10
[ 108.058975][ T925] ? __switch_to+0xc89/0x1420
[ 108.059006][ T925] ? __pfx_kthread+0x10/0x10
[ 108.059028][ T925] ret_from_fork_asm+0x1a/0x30
[ 108.059056][ T925]
[ 108.059064][ T925]
[ 108.059069][ T925] Allocated by task 925:
[ 108.059079][ T925] kasan_save_track+0x3e/0x80
[ 108.059104][ T925] __kasan_kmalloc+0x93/0xb0
[ 108.059129][ T925] __kmalloc_cache_noprof+0x321/0x600
[ 108.059152][ T925] usb_set_configuration+0x3c5/0x2260
[ 108.059182][ T925] usb_generic_driver_probe+0x8d/0x150
[ 108.059212][ T925] usb_probe_device+0x1c3/0x3b0
[ 108.059229][ T925] really_probe+0x254/0xae0
[ 108.059258][ T925] __driver_probe_device+0x1e8/0x360
[ 108.059287][ T925] driver_probe_device+0x4f/0x240
[ 108.059316][ T925] __device_attach_driver+0x270/0x410
[ 108.059346][ T925] bus_for_each_drv+0x258/0x2f0
[ 108.059367][ T925] __device_attach+0x2c4/0x450
[ 108.059394][ T925] device_initial_probe+0xa1/0xd0
[ 108.059421][ T925] bus_probe_device+0x12a/0x220
[ 108.059442][ T925] device_add+0x7d7/0xb80
[ 108.059466][ T925] usb_new_device+0x9aa/0x1690
[ 108.059491][ T925] hub_event+0x28e8/0x4d30
[ 108.059518][ T925] process_scheduled_works+0xc3d/0x1630
[ 108.059545][ T925] worker_thread+0xa47/0xfb0
[ 108.059572][ T925] kthread+0x38b/0x480
[ 108.059590][ T925] ret_from_fork+0x514/0xb70
[ 108.059607][ T925] ret_from_fork_asm+0x1a/0x30
[ 108.059625][ T925]
[ 108.059629][ T925] Freed by task 925:
[ 108.059647][ T925] kasan_save_track+0x3e/0x80
[ 108.059670][ T925] kasan_save_free_info+0x40/0x50
[ 108.059689][ T925] __kasan_slab_free+0x5c/0x80
[ 108.059714][ T925] kfree+0x1c5/0x650
[ 108.059731][ T925] device_release+0xc4/0x1f0
[ 108.059749][ T925] kobject_put+0x222/0x550
[ 108.059773][ T925] v4l2_device_disconnect+0x79/0xd0
[ 108.059794][ T925] usbtv_video_free+0x25/0x30
[ 108.059812][ T925] usbtv_disconnect+0x5c/0xa0
[ 108.059829][ T925] usb_unbind_interface+0x295/0x9f0
[ 108.059860][ T925] device_release_driver_internal+0x4f5/0x880
[ 108.059890][ T925] bus_remove_device+0x444/0x560
[ 108.059911][ T925] device_del+0x524/0x8f0
[ 108.059935][ T925] usb_disable_device+0x3d4/0x8d0
[ 108.059963][ T925] usb_disconnect+0x346/0x9a0
[ 108.059987][ T925] hub_event+0x1bbb/0x4d30
[ 108.060015][ T925] process_scheduled_works+0xc3d/0x1630
[ 108.060042][ T925] worker_thread+0xa47/0xfb0
[ 108.060069][ T925] kthread+0x38b/0x480
[ 108.060087][ T925] ret_from_fork+0x514/0xb70
[ 108.060104][ T925] ret_from_fork_asm+0x1a/0x30
[ 108.060122][ T925]
[ 108.060127][ T925] The buggy address belongs to the object at ffff88802ff0c000
[ 108.060127][ T925] which belongs to the cache kmalloc-2k of size 2048
[ 108.060144][ T925] The buggy address is located 8 bytes inside of
[ 108.060144][ T925] freed 2048-byte region [ffff88802ff0c000, ffff88802ff0c800)
[ 108.060165][ T925]
[ 108.060171][ T925] The buggy address belongs to the physical page:
[ 108.060189][ T925] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ff08
[ 108.060208][ T925] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 108.060225][ T925] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 108.060249][ T925] page_type: f5(slab)
[ 108.060268][ T925] raw: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 108.060286][ T925] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 108.060305][ T925] head: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 108.060323][ T925] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 108.060342][ T925] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 108.060358][ T925] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 108.060369][ T925] page dumped because: kasan: bad access detected
[ 108.060384][ T925] page_owner tracks the page as allocated
[ 108.060391][ T925] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4977, tgid 4977 (klogd), ts 107009336945
[ 108.060424][ T925] post_alloc_hook+0x1f9/0x250
[ 108.060444][ T925] get_page_from_freelist+0x2209/0x2280
[ 108.060468][ T925] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 108.060492][ T925] allocate_slab+0x7d/0x620
[ 108.060520][ T925] refill_objects+0x2d5/0x350
[ 108.060549][ T925] __pcs_replace_empty_main+0x2c8/0x6c0
[ 108.060577][ T925] __kmalloc_cache_noprof+0x39b/0x600
[ 108.060599][ T925] syslog_print+0x103/0x610
[ 108.060623][ T925] do_syslog+0x583/0x7d0
[ 108.060656][ T925] __x64_sys_syslog+0x7c/0x90
[ 108.060679][ T925] do_syscall_64+0x166/0x520
[ 108.060700][ T925] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.060719][ T925] page last free pid 5814 tgid 5814 ts 105644517691 stack trace:
[ 108.060734][ T925] __free_frozen_pages+0xc93/0xd90
[ 108.060753][ T925] __slab_free+0x274/0x2c0
[ 108.060775][ T925] qlist_free_all+0x99/0x100
[ 108.060796][ T925] kasan_quarantine_reduce+0x148/0x160
[ 108.060818][ T925] __kasan_slab_alloc+0x22/0x80
[ 108.060844][ T925] kmem_cache_alloc_noprof+0x2b9/0x600
[ 108.060865][ T925] vm_area_dup+0x28/0x760
[ 108.060885][ T925] __split_vma+0x1d7/0xa60
[ 108.060910][ T925] vms_gather_munmap_vmas+0x4e3/0x1370
[ 108.060937][ T925] mmap_region+0x925/0x25b0
[ 108.060964][ T925] do_mmap+0xe0a/0x1300
[ 108.060993][ T925] vm_mmap_pgoff+0x272/0x4e0
[ 108.061018][ T925] ksys_mmap_pgoff+0x4dc/0x760
[ 108.061048][ T925] do_syscall_64+0x166/0x520
[ 108.061069][ T925] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.061089][ T925]
[ 108.061094][ T925] Memory state around the buggy address:
[ 108.061106][ T925] ffff88802ff0bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.061121][ T925] ffff88802ff0bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.061135][ T925] >ffff88802ff0c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.061146][ T925] ^
[ 108.061156][ T925] ffff88802ff0c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.061171][ T925] ffff88802ff0c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.061182][ T925] ==================================================================
[ 108.094488][ T925] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 108.903138][ T925] CPU: 1 UID: 0 PID: 925 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 108.912439][ T925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 108.922513][ T925] Workqueue: usb_hub_wq hub_event
[ 108.927570][ T925] Call Trace:
[ 108.930866][ T925]
[ 108.933819][ T925] vpanic+0x56d/0xa60
[ 108.937848][ T925] ? __pfx_vpanic+0x10/0x10
[ 108.942385][ T925] ? __pfx___schedule+0x10/0x10
[ 108.947275][ T925] panic+0xc5/0xd0
[ 108.951034][ T925] ? __pfx_panic+0x10/0x10
[ 108.955489][ T925] ? preempt_schedule_thunk+0x16/0x40
[ 108.960890][ T925] ? usb_unbind_interface+0x2c2/0x9f0
[ 108.966293][ T925] check_panic_on_warn+0x89/0xb0
[ 108.971271][ T925] ? usb_unbind_interface+0x2c2/0x9f0
[ 108.976674][ T925] end_report+0x73/0x170
[ 108.980951][ T925] ? usb_unbind_interface+0x2c2/0x9f0
[ 108.986360][ T925] kasan_report+0x128/0x150
[ 108.990933][ T925] ? usb_unbind_interface+0x2c2/0x9f0
[ 108.996351][ T925] usb_unbind_interface+0x2c2/0x9f0
[ 109.001591][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 109.007375][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 109.013132][ T925] ? __pfx_usb_unbind_interface+0x10/0x10
[ 109.018883][ T925] device_release_driver_internal+0x4f5/0x880
[ 109.024989][ T925] bus_remove_device+0x444/0x560
[ 109.029981][ T925] ? __pfx_bus_remove_device+0x10/0x10
[ 109.035478][ T925] ? kernfs_remove_by_name_ns+0x101/0x140
[ 109.041230][ T925] device_del+0x524/0x8f0
[ 109.045592][ T925] ? __pfx_device_del+0x10/0x10
[ 109.050465][ T925] ? __pfx___mutex_lock+0x10/0x10
[ 109.055539][ T925] usb_disable_device+0x3d4/0x8d0
[ 109.060604][ T925] usb_disconnect+0x346/0x9a0
[ 109.065310][ T925] hub_event+0x1bbb/0x4d30
[ 109.069756][ T925] ? do_raw_spin_unlock+0xf5/0x200
[ 109.074919][ T925] ? register_lock_class+0x31/0x2e0
[ 109.080159][ T925] ? __pfx_hub_event+0x10/0x10
[ 109.084968][ T925] ? rcu_is_watching+0x16/0xb0
[ 109.089753][ T925] ? process_scheduled_works+0x97a/0x1630
[ 109.095498][ T925] process_scheduled_works+0xc3d/0x1630
[ 109.101089][ T925] ? __pfx_process_scheduled_works+0x10/0x10
[ 109.107121][ T925] ? assign_work+0x3cf/0x5d0
[ 109.111749][ T925] worker_thread+0xa47/0xfb0
[ 109.116382][ T925] ? __kthread_parkme+0x71/0x1f0
[ 109.121348][ T925] kthread+0x38b/0x480
[ 109.125440][ T925] ? __pfx_worker_thread+0x10/0x10
[ 109.130574][ T925] ? __pfx_kthread+0x10/0x10
[ 109.135188][ T925] ret_from_fork+0x514/0xb70
[ 109.139805][ T925] ? __pfx_ret_from_fork+0x10/0x10
[ 109.144953][ T925] ? __switch_to+0xc89/0x1420
[ 109.149679][ T925] ? __pfx_kthread+0x10/0x10
[ 109.154305][ T925] ret_from_fork_asm+0x1a/0x30
[ 109.159124][ T925]
[ 109.162325][ T925] Kernel Offset: disabled
[ 109.166669][ T925] Rebooting in 86400 seconds..