Warning: Permanently added '10.128.1.76' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://35107 [ 31.683566][ T4338] cgroup: Unknown subsys name 'net' [ 31.908634][ T4338] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.190554][ T4338] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 37.005229][ T4358] chnl_net:caif_netlink_parms(): no params data found [ 37.025677][ T4358] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.027202][ T4358] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.028889][ T4358] device bridge_slave_0 entered promiscuous mode [ 37.031302][ T4358] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.032564][ T4358] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.034069][ T4358] device bridge_slave_1 entered promiscuous mode [ 37.041876][ T4358] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.044196][ T4358] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.050634][ T4358] team0: Port device team_slave_0 added [ 37.052379][ T4358] team0: Port device team_slave_1 added [ 37.058473][ T4358] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.059666][ T4358] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.063940][ T4358] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.068617][ T4358] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.069877][ T4358] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.074293][ T4358] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.137429][ T4358] device hsr_slave_0 entered promiscuous mode [ 37.196469][ T4358] device hsr_slave_1 entered promiscuous mode [ 37.273009][ T4358] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.287733][ T4358] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.318857][ T4358] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.369275][ T4358] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.415240][ T4358] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.416534][ T4358] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.417893][ T4358] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.419126][ T4358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.436648][ T4358] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.440551][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.443967][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.447447][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.449291][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 37.453404][ T4358] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.458814][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.460370][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.461728][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.463306][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.464794][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.466010][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.474852][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 37.476837][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 37.480055][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 37.482766][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.485637][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.488762][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 37.542119][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 37.543577][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 37.548403][ T4358] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.555198][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.561357][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.563285][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.564836][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.567702][ T4358] device veth0_vlan entered promiscuous mode [ 37.570666][ T4358] device veth1_vlan entered promiscuous mode [ 37.578300][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 37.579968][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 37.581519][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.583890][ T4358] device veth0_macvtap entered promiscuous mode [ 37.587266][ T4358] device veth1_macvtap entered promiscuous mode [ 37.619930][ T4358] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.622326][ T4358] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.624617][ T4358] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.626004][ T4358] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.627959][ T4358] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.629454][ T4358] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.631681][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.633395][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.635027][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 38.121063][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.122536][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.124313][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 38.134300][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.135717][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.138681][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 38.878981][ T11] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.082955][ T4420] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.084700][ T4420] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.086993][ T4420] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.088558][ T4420] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.089999][ T4420] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 39.091531][ T4420] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:39 executed programs: 0 [ 39.335787][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.337663][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.339269][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.340666][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.342144][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 39.343666][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.385231][ T4430] chnl_net:caif_netlink_parms(): no params data found [ 39.401298][ T4430] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.402548][ T4430] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.404108][ T4430] device bridge_slave_0 entered promiscuous mode [ 39.406331][ T4430] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.407640][ T4430] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.409152][ T4430] device bridge_slave_1 entered promiscuous mode [ 39.415045][ T4430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.418141][ T4430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.424808][ T4430] team0: Port device team_slave_0 added [ 39.427224][ T4430] team0: Port device team_slave_1 added [ 39.432470][ T4430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.433572][ T4430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.438347][ T4430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.441040][ T4430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.442208][ T4430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.447803][ T4430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.488268][ T4430] device hsr_slave_0 entered promiscuous mode [ 39.527220][ T4430] device hsr_slave_1 entered promiscuous mode [ 39.567207][ T4430] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 39.568665][ T4430] Cannot create hsr debugfs directory [ 40.807292][ T11] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.356548][ T4420] Bluetooth: hci0: command 0x0409 tx timeout [ 43.156917][ T11] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.248866][ T11] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.436162][ T4420] Bluetooth: hci0: command 0x041b tx timeout [ 44.279260][ T4430] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 44.317736][ T4430] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 44.558498][ T4430] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 44.597105][ T4430] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 44.717778][ T4430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.721412][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.723024][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.725565][ T4430] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.779262][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.781082][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.782628][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.783828][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.785385][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.788101][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.789680][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.791291][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.792469][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.794713][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.798511][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.801992][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.803785][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.805491][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.808561][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.810256][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.813258][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.814994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.868860][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.870622][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.873045][ T4430] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 45.000257][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 45.001742][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 45.004768][ T4430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.011140][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 45.013065][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.018762][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 45.020505][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.022202][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.023734][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.025869][ T4430] device veth0_vlan entered promiscuous mode [ 45.029264][ T4430] device veth1_vlan entered promiscuous mode [ 45.035927][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 45.038466][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 45.040087][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 45.041748][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.099021][ T4430] device veth0_macvtap entered promiscuous mode [ 45.101579][ T4430] device veth1_macvtap entered promiscuous mode [ 45.105931][ T4430] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 45.107892][ T4430] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 45.110048][ T4430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 45.111430][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 45.113023][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 45.114736][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 45.117550][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.120189][ T4430] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 45.122076][ T4430] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 45.124157][ T4430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 45.125511][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 45.128061][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.130738][ T4430] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.132320][ T4430] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.133769][ T4430] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.135248][ T4430] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.196030][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 45.197803][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 45.199827][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 45.207385][ T4396] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 45.208723][ T4396] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 45.210077][ T4396] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 45.241373][ T4489] vhci_hcd vhci_hcd.0: remove, state 4 [ 45.242578][ T4489] usb usb3: USB disconnect, device number 1 [ 45.250581][ T4489] vhci_hcd vhci_hcd.0: USB bus 3 deregistered [ 45.250611][ T4396] vhci_hcd: stop threads [ 45.252544][ T4396] vhci_hcd: release socket [ 45.252830][ T4489] vhci_hcd vhci_hcd.0: remove, state 4 [ 45.253373][ T4396] ================================================================== [ 45.254484][ T4489] usb usb2: USB disconnect, device number 1 [ 45.255609][ T4396] BUG: KASAN: use-after-free in vhci_cleanup_unlink_list+0x3a8/0x3ac [ 45.258069][ T4396] Read of size 4 at addr ffff0000d2428418 by task kworker/u4:5/4396 [ 45.259148][ T4489] vhci_hcd vhci_hcd.0: USB bus 2 deregistered [ 45.259460][ T4396] [ 45.260955][ T4396] CPU: 0 PID: 4396 Comm: kworker/u4:5 Not tainted syzkaller #0 [ 45.262220][ T4396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 45.263937][ T4396] Workqueue: usbip_event event_handler [ 45.264948][ T4396] Call trace: [ 45.265536][ T4396] dump_backtrace+0x1c4/0x1f0 [ 45.266371][ T4396] show_stack+0x2c/0x3c [ 45.267135][ T4396] __dump_stack+0x30/0x40 [ 45.267908][ T4396] dump_stack_lvl+0xf4/0x15c [ 45.268687][ T4396] print_address_description+0x88/0x218 [ 45.269650][ T4396] print_report+0x50/0x68 [ 45.270432][ T4396] kasan_report+0xa8/0xfc [ 45.271169][ T4396] __asan_report_load4_noabort+0x2c/0x38 [ 45.272120][ T4396] vhci_cleanup_unlink_list+0x3a8/0x3ac [ 45.273115][ T4396] vhci_shutdown_connection+0x28c/0x574 [ 45.274058][ T4396] event_handler+0x288/0x454 [ 45.274816][ T4396] process_one_work+0x7e4/0x13bc [ 45.275637][ T4396] worker_thread+0x8cc/0xfe8 [ 45.276423][ T4396] kthread+0x254/0x2e0 [ 45.277153][ T4396] ret_from_fork+0x10/0x20 [ 45.277890][ T4396] [ 45.278327][ T4396] Allocated by task 1: [ 45.278987][ T4396] kasan_set_track+0x4c/0x80 [ 45.279744][ T4396] kasan_save_alloc_info+0x24/0x30 [ 45.280574][ T4396] __kasan_kmalloc+0xa0/0xb8 [ 45.281389][ T4396] __kmalloc+0xd8/0x180 [ 45.282109][ T4396] __usb_create_hcd+0x6c/0x740 [ 45.282925][ T4396] usb_create_shared_hcd+0x40/0x54 [ 45.283748][ T4396] vhci_hcd_probe+0x1a4/0x354 [ 45.284599][ T4396] platform_probe+0x148/0x1c8 [ 45.285394][ T4396] really_probe+0x3a0/0xac4 [ 45.286195][ T4396] __driver_probe_device+0x1c8/0x368 [ 45.287099][ T4396] driver_probe_device+0x78/0x324 [ 45.288057][ T4396] __device_attach_driver+0x28c/0x4c0 [ 45.289003][ T4396] bus_for_each_drv+0x154/0x1e4 [ 45.289831][ T4396] __device_attach+0x2a4/0x3d8 [ 45.290671][ T4396] device_initial_probe+0x24/0x34 [ 45.291531][ T4396] bus_probe_device+0xbc/0x1c4 [ 45.292291][ T4396] device_add+0x93c/0xe4c [ 45.292999][ T4396] platform_device_add+0x3f8/0x6f4 [ 45.293875][ T4396] vhci_hcd_init+0x390/0x4b0 [ 45.294667][ T4396] do_one_initcall+0x278/0x9f0 [ 45.295511][ T4396] do_initcall_level+0x158/0x214 [ 45.296340][ T4396] do_initcalls+0x58/0xac [ 45.297125][ T4396] do_basic_setup+0x8c/0xa0 [ 45.297910][ T4396] kernel_init_freeable+0x35c/0x4f0 [ 45.298779][ T4396] kernel_init+0x24/0x1d8 [ 45.299539][ T4396] ret_from_fork+0x10/0x20 [ 45.300316][ T4396] [ 45.300690][ T4396] Freed by task 4489: [ 45.301375][ T4396] kasan_set_track+0x4c/0x80 [ 45.302153][ T4396] kasan_save_free_info+0x38/0x5c [ 45.302963][ T4396] ____kasan_slab_free+0x148/0x1b0 [ 45.303816][ T4396] __kasan_slab_free+0x18/0x28 [ 45.304683][ T4396] slab_free_freelist_hook+0x16c/0x1e8 [ 45.305630][ T4396] __kmem_cache_free+0xbc/0x21c [ 45.306503][ T4396] kfree+0xd0/0x1a8 [ 45.307156][ T4396] usb_put_hcd+0x124/0x16c [ 45.307936][ T4396] vhci_hcd_remove+0x98/0x100 [ 45.308681][ T4396] platform_remove+0x98/0xf0 [ 45.309435][ T4396] device_release_driver_internal+0x3d4/0x6e4 [ 45.310396][ T4396] device_driver_detach+0x48/0x58 [ 45.311221][ T4396] unbind_store+0x2a8/0x2b4 [ 45.311983][ T4396] drv_attr_store+0x80/0xa4 [ 45.312732][ T4396] sysfs_kf_write+0x1f8/0x274 [ 45.313516][ T4396] kernfs_fop_write_iter+0x390/0x4b4 [ 45.314405][ T4396] vfs_write+0x3c8/0x7c8 [ 45.315079][ T4396] ksys_write+0x12c/0x228 [ 45.315762][ T4396] __arm64_sys_write+0x7c/0x90 [ 45.316521][ T4396] invoke_syscall+0x98/0x290 [ 45.317286][ T4396] el0_svc_common+0x13c/0x258 [ 45.318052][ T4396] do_el0_svc+0x5c/0x134 [ 45.318760][ T4396] el0_svc+0x58/0x128 [ 45.319439][ T4396] el0t_64_sync_handler+0x84/0xf0 [ 45.320296][ T4396] el0t_64_sync+0x18c/0x190 [ 45.321041][ T4396] [ 45.321469][ T4396] The buggy address belongs to the object at ffff0000d2428000 [ 45.321469][ T4396] which belongs to the cache kmalloc-8k of size 8192 [ 45.323688][ T4396] The buggy address is located 1048 bytes inside of [ 45.323688][ T4396] 8192-byte region [ffff0000d2428000, ffff0000d242a000) [ 45.326037][ T4396] [ 45.326436][ T4396] The buggy address belongs to the physical page: [ 45.327500][ T4396] page:0000000028de441c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112428 [ 45.329158][ T4396] head:0000000028de441c order:3 compound_mapcount:0 compound_pincount:0 [ 45.330477][ T4396] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 45.331894][ T4396] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002c00 [ 45.333386][ T4396] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 45.334880][ T4396] page dumped because: kasan: bad access detected [ 45.335946][ T4396] [ 45.336339][ T4396] Memory state around the buggy address: [ 45.337305][ T4396] ffff0000d2428300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.338620][ T4396] ffff0000d2428380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.340039][ T4396] >ffff0000d2428400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.341475][ T4396] ^ [ 45.342315][ T4396] ffff0000d2428480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.343705][ T4396] ffff0000d2428500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.345016][ T4396] ================================================================== [ 45.347309][ T4396] Disabling lock debugging due to kernel taint [ 45.348346][ T4396] vhci_hcd: disconnect device [ 45.349103][ T4396] vhci_hcd: stop threads [ 45.349721][ T4396] vhci_hcd: release socket [ 45.350398][ T4396] vhci_hcd: disconnect device [ 45.351417][ T4396] vhci_hcd: stop threads [ 45.354254][ T4396] vhci_hcd: release socket [ 45.355061][ T4396] vhci_hcd: disconnect device [ 45.356760][ T4396] vhci_hcd: stop threads [ 45.357509][ T4396] vhci_hcd: release socket [ 45.358360][ T4396] vhci_hcd: disconnect device [ 45.359197][ T4396] vhci_hcd: stop threads [ 45.359947][ T4396] vhci_hcd: release socket [ 45.360660][ T4396] vhci_hcd: disconnect device [ 45.361453][ T4396] vhci_hcd: stop threads [ 45.362204][ T4396] vhci_hcd: release socket [ 45.362868][ T4396] vhci_hcd: disconnect device [ 45.363763][ T4396] vhci_hcd: stop threads [ 45.364534][ T4396] vhci_hcd: release socket [ 45.365365][ T4396] vhci_hcd: disconnect device [ 45.368383][ T4396] vhci_hcd: stop threads [ 45.369139][ T4396] vhci_hcd: release socket [ 45.370033][ T4396] vhci_hcd: disconnect device [ 45.370812][ T4396] vhci_hcd: stop threads [ 45.371476][ T4396] vhci_hcd: release socket [ 45.372220][ T4396] vhci_hcd: disconnect device [ 45.373035][ T4396] vhci_hcd: stop threads [ 45.373727][ T4396] vhci_hcd: release socket [ 45.374462][ T4396] vhci_hcd: disconnect device [ 45.375238][ T4396] vhci_hcd: stop threads [ 45.375920][ T4396] vhci_hcd: release socket [ 45.386383][ T4396] vhci_hcd: disconnect device [ 45.387262][ T4396] vhci_hcd: stop threads [ 45.387956][ T4396] vhci_hcd: release socket [ 45.388669][ T4396] vhci_hcd: disconnect device [ 45.389465][ T4396] vhci_hcd: stop threads [ 45.390151][ T4396] vhci_hcd: release socket [ 45.390864][ T4396] vhci_hcd: disconnect device [ 45.391730][ T4396] vhci_hcd: stop threads [ 45.392413][ T4396] vhci_hcd: release socket [ 45.393148][ T4396] vhci_hcd: disconnect device [ 45.393942][ T4396] vhci_hcd: stop threads [ 45.394651][ T4396] vhci_hcd: release socket [ 45.395369][ T4396] vhci_hcd: disconnect device [ 45.396400][ T4396] vhci_hcd: stop threads [ 45.397177][ T4396] vhci_hcd: release socket [ 45.398074][ T4396] vhci_hcd: disconnect device