Warning: Permanently added '[localhost]:53019' (ED25519) to the list of known hosts.
2025/11/01 18:40:24 parsed 1 programs
syzkaller login: [ 84.744124][ T5315] cgroup: Unknown subsys name 'net'
[ 84.813981][ T5315] cgroup: Unknown subsys name 'cpuset'
[ 84.818997][ T5315] cgroup: Unknown subsys name 'rlimit'
[ 86.478174][ T5315] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 90.757703][ T5330] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 91.493672][ T5344] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 91.497625][ T5344] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 91.502850][ T5344] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 91.506451][ T5344] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 91.509892][ T5344] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 91.918718][ T55] cfg80211: failed to load regulatory.db
[ 94.286887][ T5372] chnl_net:caif_netlink_parms(): no params data found
[ 94.352219][ T5372] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.355854][ T5372] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.358901][ T5372] bridge_slave_0: entered allmulticast mode
[ 94.363281][ T5372] bridge_slave_0: entered promiscuous mode
[ 94.369347][ T5372] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.372732][ T5372] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.375626][ T5372] bridge_slave_1: entered allmulticast mode
[ 94.379471][ T5372] bridge_slave_1: entered promiscuous mode
[ 94.406027][ T5372] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 94.413599][ T5372] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 94.438844][ T5372] team0: Port device team_slave_0 added
[ 94.446321][ T5372] team0: Port device team_slave_1 added
[ 94.472158][ T5372] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 94.474921][ T5372] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 94.485948][ T5372] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 94.493113][ T5372] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 94.496304][ T5372] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 94.507422][ T5372] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 94.546835][ T5372] hsr_slave_0: entered promiscuous mode
[ 94.550801][ T5372] hsr_slave_1: entered promiscuous mode
[ 94.707323][ T5372] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 94.717720][ T5372] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 94.725304][ T5372] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 94.733885][ T5372] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 94.768499][ T5372] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.771916][ T5372] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 94.775842][ T5372] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.778924][ T5372] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 94.839652][ T5372] 8021q: adding VLAN 0 to HW filter on device bond0
[ 94.853827][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.858767][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.869331][ T5372] 8021q: adding VLAN 0 to HW filter on device team0
[ 94.881304][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.884466][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 94.894016][ T31] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.897312][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 95.095084][ T5372] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 95.136705][ T5372] veth0_vlan: entered promiscuous mode
[ 95.147149][ T5372] veth1_vlan: entered promiscuous mode
[ 95.174545][ T5372] veth0_macvtap: entered promiscuous mode
[ 95.182512][ T5372] veth1_macvtap: entered promiscuous mode
[ 95.195835][ T5372] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 95.208517][ T5372] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 95.219287][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.232478][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.236048][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.239850][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.452197][ T5372] syz-executor (5372) used greatest stack depth: 19256 bytes left
[ 95.497667][ T1051] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.562628][ T1051] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.662022][ T1051] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.760072][ T1051] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.373892][ T31] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.377457][ T31] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.454674][ T1041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.469496][ T1041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/11/01 18:40:39 executed programs: 0
[ 98.231472][ T1051] bridge_slave_1: left allmulticast mode
[ 98.233859][ T1051] bridge_slave_1: left promiscuous mode
[ 98.236821][ T1051] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.282865][ T1051] bridge_slave_0: left allmulticast mode
[ 98.285277][ T1051] bridge_slave_0: left promiscuous mode
[ 98.287818][ T1051] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.296860][ T4671] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 98.301391][ T4671] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 98.304790][ T4671] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 98.309911][ T4671] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 98.315271][ T4671] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 98.805892][ T1051] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 98.813492][ T1051] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 98.818377][ T1051] bond0 (unregistering): Released all slaves
[ 98.927258][ T1051] hsr_slave_0: left promiscuous mode
[ 98.939648][ T1051] hsr_slave_1: left promiscuous mode
[ 98.944961][ T1051] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 98.947981][ T1051] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 98.962784][ T1051] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 98.965922][ T1051] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 98.988314][ T1051] veth1_macvtap: left promiscuous mode
[ 98.996494][ T1051] veth0_macvtap: left promiscuous mode
[ 98.999027][ T1051] veth1_vlan: left promiscuous mode
[ 99.010859][ T1051] veth0_vlan: left promiscuous mode
[ 99.439575][ T1051] team0 (unregistering): Port device team_slave_1 removed
[ 99.457042][ T1051] team0 (unregistering): Port device team_slave_0 removed
[ 100.002432][ T5428] chnl_net:caif_netlink_parms(): no params data found
[ 100.393886][ T4671] Bluetooth: hci0: command tx timeout
[ 100.428323][ T5428] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.444644][ T5428] bridge0: port 1(bridge_slave_0) entered disabled state
[ 100.447665][ T5428] bridge_slave_0: entered allmulticast mode
[ 100.481858][ T5428] bridge_slave_0: entered promiscuous mode
[ 100.515022][ T5428] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.519888][ T5428] bridge0: port 2(bridge_slave_1) entered disabled state
[ 100.526897][ T5428] bridge_slave_1: entered allmulticast mode
[ 100.544324][ T5428] bridge_slave_1: entered promiscuous mode
[ 100.679130][ T5428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 100.702946][ T5428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 100.802458][ T5428] team0: Port device team_slave_0 added
[ 100.817053][ T5428] team0: Port device team_slave_1 added
[ 100.949843][ T5428] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 100.971930][ T5428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.000343][ T5428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 101.006806][ T5428] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 101.009876][ T5428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.035945][ T5428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 101.141780][ T5428] hsr_slave_0: entered promiscuous mode
[ 101.164888][ T5428] hsr_slave_1: entered promiscuous mode
[ 101.653254][ T5428] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 101.663040][ T5428] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 101.681695][ T5428] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 101.703404][ T5428] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 101.831440][ T5428] 8021q: adding VLAN 0 to HW filter on device bond0
[ 101.859820][ T5428] 8021q: adding VLAN 0 to HW filter on device team0
[ 101.889462][ T1051] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.892606][ T1051] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 101.922550][ T1051] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.925892][ T1051] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 101.986274][ T5428] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 102.281577][ T5428] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 102.342071][ T5428] veth0_vlan: entered promiscuous mode
[ 102.364987][ T5428] veth1_vlan: entered promiscuous mode
[ 102.402155][ T5428] veth0_macvtap: entered promiscuous mode
[ 102.425522][ T5428] veth1_macvtap: entered promiscuous mode
[ 102.454450][ T5428] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 102.471875][ T4671] Bluetooth: hci0: command tx timeout
[ 102.477356][ T5428] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 102.502116][ T1086] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.509370][ T1086] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.520801][ T1086] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.524656][ T1086] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.620321][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.623983][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 102.684544][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.687988][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 103.050864][ T55] usb 5-1: new full-speed USB device number 2 using dummy_hcd
[ 103.213352][ T55] usb 5-1: config 0 interface 0 has no altsetting 0
[ 103.218171][ T55] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[ 103.228399][ T55] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[ 103.241779][ T55] usb 5-1: Product: syz
[ 103.243592][ T55] usb 5-1: Manufacturer: syz
[ 103.248019][ T55] usb 5-1: SerialNumber: syz
[ 103.266973][ T55] usb 5-1: config 0 descriptor??
[ 103.294317][ T55] usb 5-1: selecting invalid altsetting 0
[ 103.496366][ T5494] ==================================================================
[ 103.499881][ T5494] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460
[ 103.503288][ T5494] Write of size 264 at addr ffff8880115a4280 by task syz.0.17/5494
[ 103.507488][ T5494]
[ 103.508559][ T5494] CPU: 0 UID: 0 PID: 5494 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 103.508576][ T5494] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 103.508583][ T5494] Call Trace:
[ 103.508590][ T5494]
[ 103.508596][ T5494] dump_stack_lvl+0x189/0x250
[ 103.508617][ T5494] ? __virt_addr_valid+0x1c8/0x5c0
[ 103.508633][ T5494] ? rcu_is_watching+0x15/0xb0
[ 103.508646][ T5494] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.508661][ T5494] ? rcu_is_watching+0x15/0xb0
[ 103.508673][ T5494] ? lock_release+0x4b/0x3e0
[ 103.508684][ T5494] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 103.508699][ T5494] ? __virt_addr_valid+0x1c8/0x5c0
[ 103.508714][ T5494] ? __virt_addr_valid+0x4a5/0x5c0
[ 103.508729][ T5494] print_report+0xca/0x240
[ 103.508743][ T5494] ? copy_to_urb+0x261/0x460
[ 103.508773][ T5494] kasan_report+0x118/0x150
[ 103.508790][ T5494] ? copy_to_urb+0x261/0x460
[ 103.508808][ T5494] kasan_check_range+0x2b0/0x2c0
[ 103.508823][ T5494] ? copy_to_urb+0x261/0x460
[ 103.508839][ T5494] __asan_memcpy+0x40/0x70
[ 103.508852][ T5494] copy_to_urb+0x261/0x460
[ 103.508869][ T5494] ? __kernel_text_address+0xd/0x40
[ 103.508887][ T5494] prepare_playback_urb+0x953/0x13d0
[ 103.508911][ T5494] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.508928][ T5494] ? lockdep_unlock+0x89/0x120
[ 103.508944][ T5494] ? validate_chain+0x897/0x2140
[ 103.508958][ T5494] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.508974][ T5494] prepare_outbound_urb+0x377/0xc50
[ 103.508987][ T5494] ? _copy_from_iter+0xc3d/0x1790
[ 103.509054][ T5494] ? __asan_memcpy+0x40/0x70
[ 103.509066][ T5494] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 103.509077][ T5494] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 103.509090][ T5494] snd_usb_endpoint_start+0x4d8/0x14a0
[ 103.509130][ T5494] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 103.509145][ T5494] ? do_raw_spin_lock+0x121/0x290
[ 103.509162][ T5494] start_endpoints+0xa1/0x280
[ 103.509177][ T5494] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 103.509195][ T5494] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 103.509213][ T5494] snd_pcm_do_start+0xb7/0x180
[ 103.509227][ T5494] snd_pcm_action+0xe7/0x240
[ 103.509239][ T5494] __snd_pcm_lib_xfer+0x1762/0x1ce0
[ 103.509256][ T5494] ? __pfx_interleaved_copy+0x10/0x10
[ 103.509271][ T5494] ? __pfx_default_write_copy+0x10/0x10
[ 103.509287][ T5494] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 103.509306][ T5494] snd_pcm_oss_write3+0x1bc/0x320
[ 103.509321][ T5494] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 103.509339][ T5494] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 103.509356][ T5494] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 103.509372][ T5494] snd_pcm_oss_write+0xb9c/0x1190
[ 103.509387][ T5494] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.509401][ T5494] ? bpf_lsm_file_permission+0x9/0x20
[ 103.509412][ T5494] ? security_file_permission+0x75/0x290
[ 103.509422][ T5494] ? rw_verify_area+0x255/0x4d0
[ 103.509434][ T5494] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.509446][ T5494] vfs_write+0x27e/0xb30
[ 103.509461][ T5494] ? __pfx_vfs_write+0x10/0x10
[ 103.509475][ T5494] ? __pfx_do_futex+0x10/0x10
[ 103.509495][ T5494] ksys_write+0x145/0x250
[ 103.509509][ T5494] ? __pfx_ksys_write+0x10/0x10
[ 103.509523][ T5494] ? do_syscall_64+0xbe/0xfa0
[ 103.509539][ T5494] do_syscall_64+0xfa/0xfa0
[ 103.509553][ T5494] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.509567][ T5494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.509578][ T5494] ? clear_bhb_loop+0x60/0xb0
[ 103.509590][ T5494] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.509602][ T5494] RIP: 0033:0x7fd98738efc9
[ 103.509614][ T5494] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 103.509625][ T5494] RSP: 002b:00007ffdeb951508 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 103.509638][ T5494] RAX: ffffffffffffffda RBX: 00007fd9875e5fa0 RCX: 00007fd98738efc9
[ 103.509647][ T5494] RDX: 00000000000005ce RSI: 0000200000000e00 RDI: 0000000000000004
[ 103.509655][ T5494] RBP: 00007fd987411f91 R08: 0000000000000000 R09: 0000000000000000
[ 103.509662][ T5494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.509670][ T5494] R13: 00007fd9875e5fa0 R14: 00007fd9875e5fa0 R15: 0000000000000003
[ 103.509682][ T5494]
[ 103.509686][ T5494]
[ 103.682158][ T5494] Allocated by task 5494:
[ 103.684047][ T5494] kasan_save_track+0x3e/0x80
[ 103.685891][ T5494] __kasan_kmalloc+0x93/0xb0
[ 103.687416][ T5494] __kmalloc_noprof+0x411/0x7f0
[ 103.689336][ T5494] snd_usb_endpoint_set_params+0x1610/0x29a0
[ 103.691633][ T5494] snd_usb_hw_params+0xb12/0x1280
[ 103.693578][ T5494] snd_pcm_hw_params+0x89d/0x1d30
[ 103.696050][ T5494] snd_pcm_oss_change_params_locked+0x21cb/0x3e40
[ 103.698822][ T5494] snd_pcm_oss_write+0x2fb/0x1190
[ 103.700998][ T5494] vfs_write+0x27e/0xb30
[ 103.702877][ T5494] ksys_write+0x145/0x250
[ 103.704724][ T5494] do_syscall_64+0xfa/0xfa0
[ 103.706670][ T5494] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.709211][ T5494]
[ 103.710278][ T5494] The buggy address belongs to the object at ffff8880115a4280
[ 103.710278][ T5494] which belongs to the cache kmalloc-64 of size 64
[ 103.715862][ T5494] The buggy address is located 0 bytes inside of
[ 103.715862][ T5494] allocated 54-byte region [ffff8880115a4280, ffff8880115a42b6)
[ 103.721764][ T5494]
[ 103.722863][ T5494] The buggy address belongs to the physical page:
[ 103.725653][ T5494] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115a4
[ 103.729358][ T5494] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 103.732540][ T5494] page_type: f5(slab)
[ 103.734218][ T5494] raw: 00fff00000000000 ffff88801a0418c0 ffffea000048e140 dead000000000004
[ 103.737555][ T5494] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 103.741546][ T5494] page dumped because: kasan: bad access detected
[ 103.744032][ T5494] page_owner tracks the page as allocated
[ 103.746307][ T5494] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5372, tgid 5372 (syz-executor), ts 94556091099, free_ts 92909382499
[ 103.753983][ T5494] post_alloc_hook+0x240/0x2a0
[ 103.755995][ T5494] get_page_from_freelist+0x2365/0x2440
[ 103.758382][ T5494] __alloc_frozen_pages_noprof+0x181/0x370
[ 103.760834][ T5494] allocate_slab+0x71/0x350
[ 103.762824][ T5494] ___slab_alloc+0xe94/0x18a0
[ 103.764868][ T5494] __slab_alloc+0x65/0x100
[ 103.766816][ T5494] __kmalloc_node_noprof+0x5cc/0x800
[ 103.769043][ T5494] alloc_slab_obj_exts+0x3e/0x100
[ 103.771237][ T5494] allocate_slab+0x152/0x350
[ 103.773214][ T5494] ___slab_alloc+0xe94/0x18a0
[ 103.775234][ T5494] __slab_alloc+0x65/0x100
[ 103.777185][ T5494] __kvmalloc_node_noprof+0x6ba/0x910
[ 103.779524][ T5494] alloc_netdev_mqs+0xa4b/0x11b0
[ 103.781702][ T5494] rtnl_create_link+0x31f/0xd10
[ 103.783766][ T5494] rtnl_newlink_create+0x25c/0xb00
[ 103.786001][ T5494] rtnl_newlink+0x16e4/0x1c80
[ 103.788020][ T5494] page last free pid 55 tgid 55 stack trace:
[ 103.790611][ T5494] __free_frozen_pages+0xbc4/0xd30
[ 103.792739][ T5494] kasan_depopulate_vmalloc_pte+0x6d/0x90
[ 103.795171][ T5494] __apply_to_page_range+0xb66/0x13d0
[ 103.797501][ T5494] kasan_release_vmalloc+0xa2/0xd0
[ 103.799624][ T5494] purge_vmap_node+0x214/0x8f0
[ 103.801698][ T5494] __purge_vmap_area_lazy+0x7a4/0xb40
[ 103.804026][ T5494] drain_vmap_area_work+0x27/0x40
[ 103.806276][ T5494] process_scheduled_works+0xae1/0x17b0
[ 103.808628][ T5494] worker_thread+0x8a0/0xda0
[ 103.810681][ T5494] kthread+0x711/0x8a0
[ 103.812512][ T5494] ret_from_fork+0x4bc/0x870
[ 103.814590][ T5494] ret_from_fork_asm+0x1a/0x30
[ 103.816702][ T5494]
[ 103.817814][ T5494] Memory state around the buggy address:
[ 103.820245][ T5494] ffff8880115a4180: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 103.823746][ T5494] ffff8880115a4200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 103.827224][ T5494] >ffff8880115a4280: 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc
[ 103.830735][ T5494] ^
[ 103.833347][ T5494] ffff8880115a4300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 103.836804][ T5494] ffff8880115a4380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 103.840216][ T5494] ==================================================================
[ 103.843653][ T5494] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.846628][ T5494] CPU: 0 UID: 0 PID: 5494 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 103.850491][ T5494] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 103.855261][ T5494] Call Trace:
[ 103.856785][ T5494]
[ 103.858157][ T5494] dump_stack_lvl+0x99/0x250
[ 103.860193][ T5494] ? __asan_memcpy+0x40/0x70
[ 103.862292][ T5494] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.864571][ T5494] ? __pfx__printk+0x10/0x10
[ 103.867117][ T5494] vpanic+0x237/0x6d0
[ 103.869051][ T5494] ? __pfx_vpanic+0x10/0x10
[ 103.871144][ T5494] panic+0xb9/0xc0
[ 103.872718][ T5494] ? __pfx_panic+0x10/0x10
[ 103.874611][ T5494] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.876932][ T5494] ? is_module_address+0x17/0xf0
[ 103.878999][ T5494] ? copy_to_urb+0x261/0x460
[ 103.881036][ T5494] check_panic_on_warn+0x89/0xb0
[ 103.883063][ T5494] ? copy_to_urb+0x261/0x460
[ 103.884965][ T5494] end_report+0x78/0x160
[ 103.886773][ T5494] kasan_report+0x129/0x150
[ 103.888781][ T5494] ? copy_to_urb+0x261/0x460
[ 103.890829][ T5494] kasan_check_range+0x2b0/0x2c0
[ 103.893057][ T5494] ? copy_to_urb+0x261/0x460
[ 103.895074][ T5494] __asan_memcpy+0x40/0x70
[ 103.896894][ T5494] copy_to_urb+0x261/0x460
[ 103.898824][ T5494] ? __kernel_text_address+0xd/0x40
[ 103.900943][ T5494] prepare_playback_urb+0x953/0x13d0
[ 103.903133][ T5494] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.905750][ T5494] ? lockdep_unlock+0x89/0x120
[ 103.907874][ T5494] ? validate_chain+0x897/0x2140
[ 103.910040][ T5494] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.912338][ T5494] prepare_outbound_urb+0x377/0xc50
[ 103.914541][ T5494] ? _copy_from_iter+0xc3d/0x1790
[ 103.916737][ T5494] ? __asan_memcpy+0x40/0x70
[ 103.918768][ T5494] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 103.921220][ T5494] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 103.923781][ T5494] snd_usb_endpoint_start+0x4d8/0x14a0
[ 103.926120][ T5494] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 103.928869][ T5494] ? do_raw_spin_lock+0x121/0x290
[ 103.931096][ T5494] start_endpoints+0xa1/0x280
[ 103.933197][ T5494] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 103.936099][ T5494] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 103.938975][ T5494] snd_pcm_do_start+0xb7/0x180
[ 103.941488][ T5494] snd_pcm_action+0xe7/0x240
[ 103.943815][ T5494] __snd_pcm_lib_xfer+0x1762/0x1ce0
[ 103.946100][ T5494] ? __pfx_interleaved_copy+0x10/0x10
[ 103.948455][ T5494] ? __pfx_default_write_copy+0x10/0x10
[ 103.950838][ T5494] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 103.953222][ T5494] snd_pcm_oss_write3+0x1bc/0x320
[ 103.955575][ T5494] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 103.958112][ T5494] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 103.960809][ T5494] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 103.963539][ T5494] snd_pcm_oss_write+0xb9c/0x1190
[ 103.965748][ T5494] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.968067][ T5494] ? bpf_lsm_file_permission+0x9/0x20
[ 103.970446][ T5494] ? security_file_permission+0x75/0x290
[ 103.972819][ T5494] ? rw_verify_area+0x255/0x4d0
[ 103.974942][ T5494] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.977327][ T5494] vfs_write+0x27e/0xb30
[ 103.979210][ T5494] ? __pfx_vfs_write+0x10/0x10
[ 103.981562][ T5494] ? __pfx_do_futex+0x10/0x10
[ 103.983646][ T5494] ksys_write+0x145/0x250
[ 103.985618][ T5494] ? __pfx_ksys_write+0x10/0x10
[ 103.987789][ T5494] ? do_syscall_64+0xbe/0xfa0
[ 103.989882][ T5494] do_syscall_64+0xfa/0xfa0
[ 103.991905][ T5494] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.994166][ T5494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.996791][ T5494] ? clear_bhb_loop+0x60/0xb0
[ 103.998862][ T5494] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.001397][ T5494] RIP: 0033:0x7fd98738efc9
[ 104.003506][ T5494] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 104.011993][ T5494] RSP: 002b:00007ffdeb951508 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 104.015533][ T5494] RAX: ffffffffffffffda RBX: 00007fd9875e5fa0 RCX: 00007fd98738efc9
[ 104.019044][ T5494] RDX: 00000000000005ce RSI: 0000200000000e00 RDI: 0000000000000004
[ 104.022440][ T5494] RBP: 00007fd987411f91 R08: 0000000000000000 R09: 0000000000000000
[ 104.025836][ T5494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 104.029229][ T5494] R13: 00007fd9875e5fa0 R14: 00007fd9875e5fa0 R15: 0000000000000003
[ 104.032694][ T5494]
[ 104.034489][ T5494] Kernel Offset: disabled
[ 104.036428][ T5494] Rebooting in 86400 seconds..
VM DIAGNOSIS:
18:40:45 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000073 RBX=0000000000000073 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002b0eab0
R8 =ffff8880339b8237 R9 =1ffff11006737046 R10=dffffc0000000000 R11=ffffffff85166e20
R12=dffffc0000000000 R13=ffffffff997e2921 R14=ffffffff99af6320 R15=0000000000000000
RIP=ffffffff85166e9c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055556c1a9500 ffffffff 00c00000
GS =0000 ffff88808d732000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000001000 CR3=000000004be9c000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fffff800 Opmask01=0000000000000014 Opmask02=000000000000003f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdeb94f440 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd987412fdb
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd987412fe8
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd987412fe2
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd987412ff6
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd98741307c
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd98741315a
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 2323232323232323 2323232323232323
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000336f69 6475000500060006
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000104c4a 4756420c5546470c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000