ci-upstream-kasan-gce-smack-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-smack-root/syz-executor4091227591 <...> Warning: Permanently added '10.128.1.125' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-smack-root/syz-executor4091227591", ["ci-upstream-kasan-gce-smack-root/syz-executor4091227591"], 0x7fff38215050 /* 10 vars */) = 0 brk(NULL) = 0x55555cc77000 brk(0x55555cc77d80) = 0x55555cc77d80 arch_prctl(ARCH_SET_FS, 0x55555cc77400) = 0 set_tid_address(0x55555cc776d0) = 5620 set_robust_list(0x55555cc776e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-smack-root/syz-executor4091227591", 4096) = 61 getrandom("\x0b\x03\x7c\x5e\x93\x4d\x9e\x3a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555cc77d80 brk(0x55555cc98d80) = 0x55555cc98d80 brk(0x55555cc99000) = 0x55555cc99000 mprotect(0x7fd6c0836000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5621 attached , child_tidptr=0x55555cc776d0) = 5621 [pid 5621] set_robust_list(0x55555cc776e0, 24 [pid 5620] rt_sigprocmask(SIG_SETMASK, [] [pid 5621] <... set_robust_list resumed>) = 0 [pid 5620] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5621] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5621] setpgid(0, 0) = 0 [pid 5621] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5621] write(3, "1000", 4) = 4 [pid 5621] close(3) = 0 executing program [pid 5621] write(1, "executing program\n", 18) = 18 [pid 5621] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5621] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 18 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [ 100.560203][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 18 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 9 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 39 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 4 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 8 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 8 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffea99555a0) = 8 [ 100.761617][ T31] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 100.761654][ T31] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 100.761677][ T31] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [pid 5621] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5621] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fd6c083cb4c) = -1 EINVAL (Invalid argument) [pid 5621] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fd6c083cb5c) = -1 EINVAL (Invalid argument) [ 100.841566][ T31] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 100.841602][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.841622][ T31] usb 1-1: Product: syz [ 100.841637][ T31] usb 1-1: Manufacturer: syz [ 100.841650][ T31] usb 1-1: SerialNumber: syz [pid 5621] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fd6c083cb6c) = -1 EINVAL (Invalid argument) [pid 5621] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffea99555a0) = 0 [ 100.910145][ T5621] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 100.913459][ T5621] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 100.936401][ T5621] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5621] exit_group(0) = ? [pid 5621] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5621, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5626 attached [ 101.179673][ T31] redrat3 1-1:1.0: Problem fetching firmware ID [pid 5626] set_robust_list(0x55555cc776e0, 24 [pid 5620] <... clone resumed>, child_tidptr=0x55555cc776d0) = 5626 [pid 5620] rt_sigprocmask(SIG_SETMASK, [] [pid 5626] <... set_robust_list resumed>) = 0 [pid 5620] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5626] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5626] setpgid(0, 0) = 0 [pid 5626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5626] write(3, "1000", 4) = 4 [pid 5626] close(3) = 0 [pid 5626] write(1, "executing program\n", 18) = 18 executing program [pid 5626] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5626] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffea99565b0) = 0 [pid 5626] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5626] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffea99565b0) = 0 [ 101.252102][ T31] redrat3 1-1:1.0: Failed to read timeout from hardware [ 101.330007][ T31] rc_core: IR keymap rc-hauppauge not found [ 101.330033][ T31] Registered IR keymap rc-empty [ 101.336914][ T31] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 101.339295][ T31] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input5 [ 101.364205][ T31] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 101.364891][ T31] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 101.364937][ T31] redrat3 1-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 101.416518][ T31] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 101.445931][ T31] usb 1-1: USB disconnect, device number 2 [ 101.453140][ T4968] ================================================================== [ 101.453158][ T4968] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 [ 101.453215][ T4968] Read of size 1 at addr ffff8880290e1748 by task udevd/4968 [ 101.453231][ T4968] [ 101.453244][ T4968] CPU: 1 UID: 0 PID: 4968 Comm: udevd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 101.453266][ T4968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.453278][ T4968] Call Trace: [ 101.453285][ T4968] [ 101.453293][ T4968] dump_stack_lvl+0xe8/0x150 [ 101.453336][ T4968] print_address_description+0x55/0x1e0 [ 101.453366][ T4968] ? string+0x216/0x2d0 [ 101.453384][ T4968] print_report+0x58/0x70 [ 101.453407][ T4968] kasan_report+0x117/0x150 [ 101.453431][ T4968] ? string+0x216/0x2d0 [ 101.453452][ T4968] string+0x216/0x2d0 [ 101.453472][ T4968] vsnprintf+0x74a/0xef0 [ 101.453495][ T4968] add_uevent_var+0x1ce/0x460 [ 101.453521][ T4968] ? __pfx_add_uevent_var+0x10/0x10 [ 101.453540][ T4968] ? lockdep_hardirqs_on+0x7a/0x110 [ 101.453564][ T4968] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 101.453588][ T4968] ? mutex_lock_nested+0x152/0x1d0 [ 101.453605][ T4968] ? rc_dev_uevent+0x34/0x1a0 [ 101.453631][ T4968] rc_dev_uevent+0x164/0x1a0 [ 101.453648][ T4968] dev_uevent+0x53a/0x870 [ 101.453670][ T4968] ? __pfx_dev_uevent+0x10/0x10 [ 101.453688][ T4968] ? __kasan_kmalloc+0x93/0xb0 [ 101.453707][ T4968] ? __kmalloc_cache_noprof+0x3d2/0x6b0 [ 101.453732][ T4968] ? sysfs_file_kobj+0x1a/0x230 [ 101.453757][ T4968] ? uevent_show+0x15c/0x310 [ 101.453778][ T4968] uevent_show+0x1a0/0x310 [ 101.453796][ T4968] dev_attr_show+0x58/0xc0 [ 101.453813][ T4968] ? __pfx_dev_attr_show+0x10/0x10 [ 101.453831][ T4968] sysfs_kf_seq_show+0x331/0x490 [ 101.453851][ T4968] seq_read_iter+0x464/0xcb0 [ 101.453882][ T4968] vfs_read+0x59e/0xa90 [ 101.453906][ T4968] ? __pfx_vfs_read+0x10/0x10 [ 101.453928][ T4968] ? do_sys_openat2+0x14e/0x200 [ 101.453953][ T4968] ksys_read+0x156/0x270 [ 101.453975][ T4968] ? __pfx_ksys_read+0x10/0x10 [ 101.453999][ T4968] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.454018][ T4968] do_syscall_64+0x174/0x580 [ 101.454042][ T4968] ? trace_irq_disable+0x3b/0x140 [ 101.454060][ T4968] ? clear_bhb_loop+0x40/0x90 [ 101.454080][ T4968] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.454098][ T4968] RIP: 0033:0x7fb70b8c8407 [ 101.454115][ T4968] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 101.454131][ T4968] RSP: 002b:00007fffb0156ca0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 101.454152][ T4968] RAX: ffffffffffffffda RBX: 00007fb70b7da880 RCX: 00007fb70b8c8407 [ 101.454166][ T4968] RDX: 0000000000001000 RSI: 000056302d2382f0 RDI: 000000000000000c [ 101.454178][ T4968] RBP: 00007fb70ba10ff0 R08: 0000000000000000 R09: 0000000000000000 [ 101.454190][ T4968] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 101.454201][ T4968] R13: 00007fb70ba10ea0 R14: 0000000000000000 R15: 000056302d1da8a0 [ 101.454221][ T4968] [ 101.454227][ T4968] [ 101.454231][ T4968] Allocated by task 31: [ 101.454240][ T4968] kasan_save_track+0x3e/0x80 [ 101.454257][ T4968] __kasan_kmalloc+0x93/0xb0 [ 101.454273][ T4968] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 101.454290][ T4968] redrat3_dev_probe+0x477/0x2570 [ 101.454312][ T4968] usb_probe_interface+0x653/0xc60 [ 101.454341][ T4968] really_probe+0x254/0xae0 [ 101.454363][ T4968] __driver_probe_device+0x1e8/0x360 [ 101.454385][ T4968] driver_probe_device+0x4f/0x240 [ 101.454407][ T4968] __device_attach_driver+0x270/0x410 [ 101.454431][ T4968] bus_for_each_drv+0x25b/0x2f0 [ 101.454447][ T4968] __device_attach+0x2c7/0x450 [ 101.454468][ T4968] device_initial_probe+0xa1/0xd0 [ 101.454489][ T4968] bus_probe_device+0x12d/0x220 [ 101.454506][ T4968] device_add+0x7d7/0xb80 [ 101.454526][ T4968] usb_set_configuration+0x1ad8/0x2180 [ 101.454544][ T4968] usb_generic_driver_probe+0x8d/0x150 [ 101.454562][ T4968] usb_probe_device+0x1c3/0x3b0 [ 101.454581][ T4968] really_probe+0x254/0xae0 [ 101.454603][ T4968] __driver_probe_device+0x1e8/0x360 [ 101.454625][ T4968] driver_probe_device+0x4f/0x240 [ 101.454647][ T4968] __device_attach_driver+0x270/0x410 [ 101.454670][ T4968] bus_for_each_drv+0x25b/0x2f0 [ 101.454686][ T4968] __device_attach+0x2c7/0x450 [ 101.454707][ T4968] device_initial_probe+0xa1/0xd0 [ 101.454728][ T4968] bus_probe_device+0x12d/0x220 [ 101.454745][ T4968] device_add+0x7d7/0xb80 [ 101.454763][ T4968] usb_new_device+0x98d/0x1610 [ 101.454778][ T4968] hub_event+0x28cf/0x4cf0 [ 101.454794][ T4968] process_scheduled_works+0xa8e/0x14e0 [ 101.454814][ T4968] worker_thread+0xa47/0xfb0 [ 101.454833][ T4968] kthread+0x388/0x470 [ 101.454856][ T4968] ret_from_fork+0x514/0xb70 [ 101.454879][ T4968] ret_from_fork_asm+0x1a/0x30 [ 101.454894][ T4968] [ 101.454899][ T4968] Freed by task 31: [ 101.454907][ T4968] kasan_save_track+0x3e/0x80 [ 101.454922][ T4968] kasan_save_free_info+0x40/0x50 [ 101.454944][ T4968] __kasan_slab_free+0x5c/0x80 [ 101.454960][ T4968] kfree+0x1c5/0x6c0 [ 101.454975][ T4968] redrat3_dev_probe+0x1bf4/0x2570 [ 101.454996][ T4968] usb_probe_interface+0x653/0xc60 [ 101.455016][ T4968] really_probe+0x254/0xae0 [ 101.455038][ T4968] __driver_probe_device+0x1e8/0x360 [ 101.455066][ T4968] driver_probe_device+0x4f/0x240 [ 101.455088][ T4968] __device_attach_driver+0x270/0x410 [ 101.455111][ T4968] bus_for_each_drv+0x25b/0x2f0 [ 101.455128][ T4968] __device_attach+0x2c7/0x450 [ 101.455148][ T4968] device_initial_probe+0xa1/0xd0 [ 101.455169][ T4968] bus_probe_device+0x12d/0x220 [ 101.455185][ T4968] device_add+0x7d7/0xb80 [ 101.455204][ T4968] usb_set_configuration+0x1ad8/0x2180 [ 101.455222][ T4968] usb_generic_driver_probe+0x8d/0x150 [ 101.455240][ T4968] usb_probe_device+0x1c3/0x3b0 [ 101.455258][ T4968] really_probe+0x254/0xae0 [ 101.455279][ T4968] __driver_probe_device+0x1e8/0x360 [ 101.455301][ T4968] driver_probe_device+0x4f/0x240 [ 101.455330][ T4968] __device_attach_driver+0x270/0x410 [ 101.455353][ T4968] bus_for_each_drv+0x25b/0x2f0 [ 101.455369][ T4968] __device_attach+0x2c7/0x450 [ 101.455390][ T4968] device_initial_probe+0xa1/0xd0 [ 101.455411][ T4968] bus_probe_device+0x12d/0x220 [ 101.455427][ T4968] device_add+0x7d7/0xb80 [ 101.455446][ T4968] usb_new_device+0x98d/0x1610 [ 101.455460][ T4968] hub_event+0x28cf/0x4cf0 [ 101.455476][ T4968] process_scheduled_works+0xa8e/0x14e0 [ 101.455494][ T4968] worker_thread+0xa47/0xfb0 [ 101.455513][ T4968] kthread+0x388/0x470 [ 101.455535][ T4968] ret_from_fork+0x514/0xb70 [ 101.455557][ T4968] ret_from_fork_asm+0x1a/0x30 [ 101.455572][ T4968] [ 101.455576][ T4968] The buggy address belongs to the object at ffff8880290e1000 [ 101.455576][ T4968] which belongs to the cache kmalloc-2k of size 2048 [ 101.455591][ T4968] The buggy address is located 1864 bytes inside of [ 101.455591][ T4968] freed 2048-byte region [ffff8880290e1000, ffff8880290e1800) [ 101.455610][ T4968] [ 101.455615][ T4968] The buggy address belongs to the physical page: [ 101.455625][ T4968] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x290e0 [ 101.455642][ T4968] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 101.455656][ T4968] flags: 0x80000000000040(head|node=0|zone=1) [ 101.455672][ T4968] page_type: f5(slab) [ 101.455688][ T4968] raw: 0080000000000040 ffff88813ffb3000 dead000000000100 dead000000000122 [ 101.455704][ T4968] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 101.455720][ T4968] head: 0080000000000040 ffff88813ffb3000 dead000000000100 dead000000000122 [ 101.455735][ T4968] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 101.455750][ T4968] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 101.455765][ T4968] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 101.455773][ T4968] page dumped because: kasan: bad access detected [ 101.455782][ T4968] page_owner tracks the page as allocated [ 101.455788][ T4968] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12164494353, free_ts 0 [ 101.455820][ T4968] post_alloc_hook+0x1f9/0x250 [ 101.455835][ T4968] get_page_from_freelist+0x262a/0x26a0 [ 101.455854][ T4968] __alloc_frozen_pages_noprof+0x18d/0x380 [ 101.455874][ T4968] allocate_slab+0x79/0x5e0 [ 101.455894][ T4968] refill_objects+0x2d8/0x350 [ 101.455916][ T4968] __pcs_replace_empty_main+0x330/0x690 [ 101.455937][ T4968] __kmalloc_cache_noprof+0x468/0x6b0 [ 101.455954][ T4968] class_register+0xbd/0x3b0 [ 101.455969][ T4968] mon_bin_init+0x12/0xa0 [ 101.455999][ T4968] mon_init+0xad/0x1d0 [ 101.456017][ T4968] do_one_initcall+0x250/0x870 [ 101.456031][ T4968] do_initcall_level+0x10a/0x1a0 [ 101.456048][ T4968] do_initcalls+0x59/0xa0 [ 101.456062][ T4968] kernel_init_freeable+0x29d/0x3e0 [ 101.456077][ T4968] kernel_init+0x1d/0x1d0 [ 101.456092][ T4968] ret_from_fork+0x514/0xb70 [ 101.456115][ T4968] page_owner free stack trace missing [ 101.456121][ T4968] [ 101.456125][ T4968] Memory state around the buggy address: [ 101.456135][ T4968] ffff8880290e1600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.456146][ T4968] ffff8880290e1680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.456157][ T4968] >ffff8880290e1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.456166][ T4968] ^ [ 101.456175][ T4968] ffff8880290e1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.456186][ T4968] ffff8880290e1800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.456195][ T4968] ================================================================== [ 101.456236][ T4968] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.456250][ T4968] CPU: 1 UID: 0 PID: 4968 Comm: udevd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 101.456271][ T4968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.456280][ T4968] Call Trace: [ 101.456288][ T4968] [ 101.456295][ T4968] vpanic+0x56c/0xa60 [ 101.456315][ T4968] ? __pfx_vpanic+0x10/0x10 [ 101.456339][ T4968] ? __pfx___schedule+0x10/0x10 [ 101.456363][ T4968] panic+0xc5/0xd0 [ 101.456380][ T4968] ? __pfx_panic+0x10/0x10 [ 101.456398][ T4968] ? preempt_schedule_thunk+0x16/0x40 [ 101.456421][ T4968] ? string+0x216/0x2d0 [ 101.456438][ T4968] check_panic_on_warn+0x89/0xb0 [ 101.456456][ T4968] ? string+0x216/0x2d0 [ 101.456472][ T4968] end_report+0x73/0x170 [ 101.456492][ T4968] ? string+0x216/0x2d0 [ 101.456507][ T4968] kasan_report+0x128/0x150 [ 101.456529][ T4968] ? string+0x216/0x2d0 [ 101.456550][ T4968] string+0x216/0x2d0 [ 101.456572][ T4968] vsnprintf+0x74a/0xef0 [ 101.456596][ T4968] add_uevent_var+0x1ce/0x460 [ 101.456622][ T4968] ? __pfx_add_uevent_var+0x10/0x10 [ 101.456643][ T4968] ? lockdep_hardirqs_on+0x7a/0x110 [ 101.456666][ T4968] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 101.456690][ T4968] ? mutex_lock_nested+0x152/0x1d0 [ 101.456709][ T4968] ? rc_dev_uevent+0x34/0x1a0 [ 101.456726][ T4968] rc_dev_uevent+0x164/0x1a0 [ 101.456742][ T4968] dev_uevent+0x53a/0x870 [ 101.456762][ T4968] ? __pfx_dev_uevent+0x10/0x10 [ 101.456778][ T4968] ? __kasan_kmalloc+0x93/0xb0 [ 101.456796][ T4968] ? __kmalloc_cache_noprof+0x3d2/0x6b0 [ 101.456814][ T4968] ? sysfs_file_kobj+0x1a/0x230 [ 101.456837][ T4968] ? uevent_show+0x15c/0x310 [ 101.456856][ T4968] uevent_show+0x1a0/0x310 [ 101.456874][ T4968] dev_attr_show+0x58/0xc0 [ 101.456888][ T4968] ? __pfx_dev_attr_show+0x10/0x10 [ 101.456905][ T4968] sysfs_kf_seq_show+0x331/0x490 [ 101.456924][ T4968] seq_read_iter+0x464/0xcb0 [ 101.456954][ T4968] vfs_read+0x59e/0xa90 [ 101.456978][ T4968] ? __pfx_vfs_read+0x10/0x10 [ 101.456998][ T4968] ? do_sys_openat2+0x14e/0x200 [ 101.457022][ T4968] ksys_read+0x156/0x270 [ 101.457043][ T4968] ? __pfx_ksys_read+0x10/0x10 [ 101.457065][ T4968] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.457082][ T4968] do_syscall_64+0x174/0x580 [ 101.457103][ T4968] ? trace_irq_disable+0x3b/0x140 [ 101.457119][ T4968] ? clear_bhb_loop+0x40/0x90 [ 101.457136][ T4968] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.457152][ T4968] RIP: 0033:0x7fb70b8c8407 [ 101.457167][ T4968] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 101.457180][ T4968] RSP: 002b:00007fffb0156ca0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 101.457198][ T4968] RAX: ffffffffffffffda RBX: 00007fb70b7da880 RCX: 00007fb70b8c8407 [ 101.457210][ T4968] RDX: 0000000000001000 RSI: 000056302d2382f0 RDI: 000000000000000c [ 101.457222][ T4968] RBP: 00007fb70ba10ff0 R08: 0000000000000000 R09: 0000000000000000 [ 101.457232][ T4968] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 101.457242][ T4968] R13: 00007fb70ba10ea0 R14: 0000000000000000 R15: 000056302d1da8a0 [ 101.457259][ T4968] [ 101.457848][ T4968] Kernel Offset: disabled