Warning: Permanently added '[localhost]:35627' (ED25519) to the list of known hosts.
2025/11/01 16:20:05 parsed 1 programs
syzkaller login: [ 84.640082][ T5310] cgroup: Unknown subsys name 'net'
[ 84.709695][ T5310] cgroup: Unknown subsys name 'cpuset'
[ 84.718240][ T5310] cgroup: Unknown subsys name 'rlimit'
[ 86.386502][ T5310] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 91.112852][ T5325] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 91.890703][ T9] cfg80211: failed to load regulatory.db
[ 94.630813][ T5376] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 94.635266][ T46] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 94.647073][ T46] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 94.650657][ T46] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 94.654168][ T46] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 95.089350][ T1042] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 95.092682][ T1042] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 95.125151][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 95.130574][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 96.112910][ T5393] chnl_net:caif_netlink_parms(): no params data found
[ 96.229014][ T5393] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.232131][ T5393] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.235195][ T5393] bridge_slave_0: entered allmulticast mode
[ 96.248308][ T5393] bridge_slave_0: entered promiscuous mode
[ 96.257743][ T5393] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.260698][ T5393] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.263629][ T5393] bridge_slave_1: entered allmulticast mode
[ 96.277619][ T5393] bridge_slave_1: entered promiscuous mode
[ 96.328709][ T5393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 96.335198][ T5393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.370767][ T5393] team0: Port device team_slave_0 added
[ 96.375482][ T5393] team0: Port device team_slave_1 added
[ 96.397766][ T5393] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.400756][ T5393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 96.412310][ T5393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.420395][ T5393] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.423351][ T5393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 96.434831][ T5393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.472605][ T5393] hsr_slave_0: entered promiscuous mode
[ 96.476951][ T5393] hsr_slave_1: entered promiscuous mode
[ 96.630181][ T5393] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 96.640252][ T5393] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 96.652913][ T5393] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 96.660944][ T5393] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 96.740520][ T5393] 8021q: adding VLAN 0 to HW filter on device bond0
[ 96.758947][ T5393] 8021q: adding VLAN 0 to HW filter on device team0
[ 96.769785][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.772986][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 96.788442][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.791603][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 96.834556][ T5393] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 96.991855][ T5393] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 97.034627][ T5393] veth0_vlan: entered promiscuous mode
[ 97.044222][ T5393] veth1_vlan: entered promiscuous mode
[ 97.072358][ T5393] veth0_macvtap: entered promiscuous mode
[ 97.079531][ T5393] veth1_macvtap: entered promiscuous mode
[ 97.093254][ T5393] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 97.104147][ T5393] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 97.118649][ T1042] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.131344][ T1042] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.135232][ T1042] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.157410][ T1042] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.277249][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.321826][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.377044][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.448962][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/01 16:20:21 executed programs: 0
[ 98.307834][ T4666] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 98.312116][ T4666] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 98.315633][ T4666] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 98.320399][ T4666] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 98.323987][ T4666] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 98.631225][ T5418] chnl_net:caif_netlink_parms(): no params data found
[ 98.742302][ T5418] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.745338][ T5418] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.748711][ T5418] bridge_slave_0: entered allmulticast mode
[ 98.753099][ T5418] bridge_slave_0: entered promiscuous mode
[ 98.758283][ T5418] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.761426][ T5418] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.764477][ T5418] bridge_slave_1: entered allmulticast mode
[ 98.768709][ T5418] bridge_slave_1: entered promiscuous mode
[ 98.790603][ T5418] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 98.797573][ T5418] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 98.820690][ T5418] team0: Port device team_slave_0 added
[ 98.825245][ T5418] team0: Port device team_slave_1 added
[ 98.845731][ T5418] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 98.849707][ T5418] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.861464][ T5418] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 98.868103][ T5418] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 98.871133][ T5418] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.885692][ T5418] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 98.925623][ T5418] hsr_slave_0: entered promiscuous mode
[ 98.930183][ T5418] hsr_slave_1: entered promiscuous mode
[ 98.934781][ T5418] debugfs: 'hsr0' already exists in 'hsr'
[ 98.938503][ T5418] Cannot create hsr debugfs directory
[ 100.049134][ T13] bridge_slave_1: left allmulticast mode
[ 100.051690][ T13] bridge_slave_1: left promiscuous mode
[ 100.054921][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 100.082836][ T13] bridge_slave_0: left allmulticast mode
[ 100.085279][ T13] bridge_slave_0: left promiscuous mode
[ 100.092139][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 100.338294][ T4666] Bluetooth: hci0: command tx timeout
[ 100.493401][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 100.499593][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 100.505074][ T13] bond0 (unregistering): Released all slaves
[ 100.614246][ T13] hsr_slave_0: left promiscuous mode
[ 100.624392][ T13] hsr_slave_1: left promiscuous mode
[ 100.630390][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 100.633631][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 100.648294][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 100.652338][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 100.679595][ T13] veth1_macvtap: left promiscuous mode
[ 100.682269][ T13] veth0_macvtap: left promiscuous mode
[ 100.684799][ T13] veth1_vlan: left promiscuous mode
[ 100.696299][ T13] veth0_vlan: left promiscuous mode
[ 101.073534][ T13] team0 (unregistering): Port device team_slave_1 removed
[ 101.091832][ T13] team0 (unregistering): Port device team_slave_0 removed
[ 101.554026][ T5418] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 101.567910][ T5418] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 101.640332][ T5418] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 101.666759][ T5418] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 101.850217][ T5418] 8021q: adding VLAN 0 to HW filter on device bond0
[ 101.881832][ T5418] 8021q: adding VLAN 0 to HW filter on device team0
[ 101.900267][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.903417][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 101.928615][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.931656][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 102.223596][ T5418] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 102.262447][ T5418] veth0_vlan: entered promiscuous mode
[ 102.270112][ T5418] veth1_vlan: entered promiscuous mode
[ 102.294076][ T5418] veth0_macvtap: entered promiscuous mode
[ 102.300465][ T5418] veth1_macvtap: entered promiscuous mode
[ 102.313853][ T5418] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 102.324942][ T5418] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 102.335259][ T1038] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.342837][ T1038] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.357415][ T1038] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.361043][ T1038] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.416642][ T4666] Bluetooth: hci0: command tx timeout
[ 102.441109][ T1038] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.444733][ T1038] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 102.493526][ T1038] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.498567][ T1038] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 102.826731][ T4766] usb 5-1: new full-speed USB device number 2 using dummy_hcd
[ 103.000098][ T4766] usb 5-1: config 0 interface 0 has no altsetting 0
[ 103.009161][ T4766] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[ 103.013052][ T4766] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[ 103.020090][ T4766] usb 5-1: Product: syz
[ 103.021910][ T4766] usb 5-1: Manufacturer: syz
[ 103.023893][ T4766] usb 5-1: SerialNumber: syz
[ 103.030540][ T4766] usb 5-1: config 0 descriptor??
[ 103.043300][ T4766] usb 5-1: selecting invalid altsetting 0
[ 103.240021][ T5460] ==================================================================
[ 103.243654][ T5460] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460
[ 103.247024][ T5460] Write of size 264 at addr ffff8880119d4e80 by task syz.0.17/5460
[ 103.251338][ T5460]
[ 103.252475][ T5460] CPU: 0 UID: 0 PID: 5460 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 103.252491][ T5460] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 103.252498][ T5460] Call Trace:
[ 103.252512][ T5460]
[ 103.252517][ T5460] dump_stack_lvl+0x189/0x250
[ 103.252539][ T5460] ? __virt_addr_valid+0x1c8/0x5c0
[ 103.252553][ T5460] ? rcu_is_watching+0x15/0xb0
[ 103.252566][ T5460] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.252579][ T5460] ? rcu_is_watching+0x15/0xb0
[ 103.252591][ T5460] ? lock_release+0x4b/0x3e0
[ 103.252601][ T5460] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 103.252615][ T5460] ? __virt_addr_valid+0x1c8/0x5c0
[ 103.252629][ T5460] ? __virt_addr_valid+0x4a5/0x5c0
[ 103.252643][ T5460] print_report+0xca/0x240
[ 103.252656][ T5460] ? copy_to_urb+0x261/0x460
[ 103.252673][ T5460] kasan_report+0x118/0x150
[ 103.252689][ T5460] ? copy_to_urb+0x261/0x460
[ 103.252705][ T5460] kasan_check_range+0x2b0/0x2c0
[ 103.252719][ T5460] ? copy_to_urb+0x261/0x460
[ 103.252734][ T5460] __asan_memcpy+0x40/0x70
[ 103.252746][ T5460] copy_to_urb+0x261/0x460
[ 103.252762][ T5460] ? __kernel_text_address+0xd/0x40
[ 103.252778][ T5460] prepare_playback_urb+0x953/0x13d0
[ 103.252800][ T5460] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.252815][ T5460] ? lockdep_unlock+0x89/0x120
[ 103.252830][ T5460] ? validate_chain+0x897/0x2140
[ 103.252843][ T5460] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.252857][ T5460] prepare_outbound_urb+0x377/0xc50
[ 103.252870][ T5460] ? _copy_from_iter+0xc3d/0x1790
[ 103.252940][ T5460] ? __asan_memcpy+0x40/0x70
[ 103.252952][ T5460] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 103.252964][ T5460] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 103.252976][ T5460] snd_usb_endpoint_start+0x4d8/0x14a0
[ 103.252992][ T5460] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 103.253003][ T5460] ? do_raw_spin_lock+0x121/0x290
[ 103.253018][ T5460] start_endpoints+0xa1/0x280
[ 103.253032][ T5460] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 103.253049][ T5460] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 103.253065][ T5460] snd_pcm_do_start+0xb7/0x180
[ 103.253079][ T5460] snd_pcm_action+0xe7/0x240
[ 103.253089][ T5460] __snd_pcm_lib_xfer+0x1762/0x1ce0
[ 103.253105][ T5460] ? __pfx_interleaved_copy+0x10/0x10
[ 103.253118][ T5460] ? __pfx_default_write_copy+0x10/0x10
[ 103.253134][ T5460] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 103.253149][ T5460] snd_pcm_oss_write3+0x1bc/0x320
[ 103.253163][ T5460] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 103.253180][ T5460] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 103.253194][ T5460] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 103.253211][ T5460] snd_pcm_oss_write+0xb9c/0x1190
[ 103.253226][ T5460] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.253239][ T5460] ? bpf_lsm_file_permission+0x9/0x20
[ 103.253249][ T5460] ? security_file_permission+0x75/0x290
[ 103.253261][ T5460] ? rw_verify_area+0x255/0x4d0
[ 103.253274][ T5460] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.253286][ T5460] vfs_write+0x27e/0xb30
[ 103.253298][ T5460] ? __pfx_vfs_write+0x10/0x10
[ 103.253311][ T5460] ? __pfx_do_futex+0x10/0x10
[ 103.253330][ T5460] ksys_write+0x145/0x250
[ 103.253342][ T5460] ? __pfx_ksys_write+0x10/0x10
[ 103.253354][ T5460] ? do_syscall_64+0xbe/0xfa0
[ 103.253369][ T5460] do_syscall_64+0xfa/0xfa0
[ 103.253382][ T5460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.253393][ T5460] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 103.253403][ T5460] ? clear_bhb_loop+0x60/0xb0
[ 103.253415][ T5460] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.253426][ T5460] RIP: 0033:0x7fc20d38efc9
[ 103.253438][ T5460] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 103.253447][ T5460] RSP: 002b:00007ffde4421438 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 103.253460][ T5460] RAX: ffffffffffffffda RBX: 00007fc20d5e5fa0 RCX: 00007fc20d38efc9
[ 103.253468][ T5460] RDX: 00000000000005ce RSI: 0000200000000e00 RDI: 0000000000000004
[ 103.253475][ T5460] RBP: 00007fc20d411f91 R08: 0000000000000000 R09: 0000000000000000
[ 103.253481][ T5460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.253487][ T5460] R13: 00007fc20d5e5fa0 R14: 00007fc20d5e5fa0 R15: 0000000000000003
[ 103.253498][ T5460]
[ 103.253511][ T5460]
[ 103.437970][ T5460] Allocated by task 5460:
[ 103.439828][ T5460] kasan_save_track+0x3e/0x80
[ 103.441890][ T5460] __kasan_kmalloc+0x93/0xb0
[ 103.444075][ T5460] __kmalloc_noprof+0x411/0x7f0
[ 103.446237][ T5460] snd_usb_endpoint_set_params+0x1610/0x29a0
[ 103.448910][ T5460] snd_usb_hw_params+0xb12/0x1280
[ 103.451088][ T5460] snd_pcm_hw_params+0x89d/0x1d30
[ 103.453297][ T5460] snd_pcm_oss_change_params_locked+0x21cb/0x3e40
[ 103.456117][ T5460] snd_pcm_oss_write+0x2fb/0x1190
[ 103.458304][ T5460] vfs_write+0x27e/0xb30
[ 103.460182][ T5460] ksys_write+0x145/0x250
[ 103.462026][ T5460] do_syscall_64+0xfa/0xfa0
[ 103.464060][ T5460] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.466579][ T5460]
[ 103.467660][ T5460] The buggy address belongs to the object at ffff8880119d4e80
[ 103.467660][ T5460] which belongs to the cache kmalloc-64 of size 64
[ 103.473719][ T5460] The buggy address is located 0 bytes inside of
[ 103.473719][ T5460] allocated 54-byte region [ffff8880119d4e80, ffff8880119d4eb6)
[ 103.479566][ T5460]
[ 103.480638][ T5460] The buggy address belongs to the physical page:
[ 103.483395][ T5460] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119d4
[ 103.487186][ T5460] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 103.490852][ T5460] page_type: f5(slab)
[ 103.492611][ T5460] raw: 00fff00000000000 ffff88801a0418c0 ffffea0000c17d40 dead000000000002
[ 103.496308][ T5460] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 103.500085][ T5460] page dumped because: kasan: bad access detected
[ 103.502808][ T5460] page_owner tracks the page as allocated
[ 103.505387][ T5460] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5393, tgid 5393 (syz-executor), ts 96482197191, free_ts 95778151769
[ 103.513719][ T5460] post_alloc_hook+0x240/0x2a0
[ 103.515823][ T5460] get_page_from_freelist+0x2365/0x2440
[ 103.518303][ T5460] __alloc_frozen_pages_noprof+0x181/0x370
[ 103.521255][ T5460] allocate_slab+0x71/0x350
[ 103.523383][ T5460] ___slab_alloc+0xe94/0x18a0
[ 103.525477][ T5460] __slab_alloc+0x65/0x100
[ 103.527612][ T5460] __kmalloc_node_noprof+0x5cc/0x800
[ 103.530116][ T5460] alloc_slab_obj_exts+0x3e/0x100
[ 103.532483][ T5460] allocate_slab+0x152/0x350
[ 103.534542][ T5460] ___slab_alloc+0xe94/0x18a0
[ 103.536720][ T5460] __slab_alloc+0x65/0x100
[ 103.538623][ T5460] __kvmalloc_node_noprof+0x6ba/0x910
[ 103.541021][ T5460] alloc_netdev_mqs+0x8a6/0x11b0
[ 103.543244][ T5460] rtnl_create_link+0x31f/0xd10
[ 103.545380][ T5460] rtnl_newlink_create+0x25c/0xb00
[ 103.547559][ T5460] rtnl_newlink+0x16e4/0x1c80
[ 103.549587][ T5460] page last free pid 15 tgid 15 stack trace:
[ 103.552267][ T5460] __free_frozen_pages+0xbc4/0xd30
[ 103.554556][ T5460] tlb_remove_table_rcu+0x85/0x100
[ 103.557051][ T5460] rcu_core+0xcab/0x1770
[ 103.558932][ T5460] handle_softirqs+0x286/0x870
[ 103.561077][ T5460] run_ksoftirqd+0x9b/0x100
[ 103.563135][ T5460] smpboot_thread_fn+0x542/0xa60
[ 103.565318][ T5460] kthread+0x711/0x8a0
[ 103.567168][ T5460] ret_from_fork+0x4bc/0x870
[ 103.569200][ T5460] ret_from_fork_asm+0x1a/0x30
[ 103.571268][ T5460]
[ 103.572725][ T5460] Memory state around the buggy address:
[ 103.575896][ T5460] ffff8880119d4d80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 103.580254][ T5460] ffff8880119d4e00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 103.583769][ T5460] >ffff8880119d4e80: 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc
[ 103.587315][ T5460] ^
[ 103.589769][ T5460] ffff8880119d4f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 103.593250][ T5460] ffff8880119d4f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 103.596659][ T5460] ==================================================================
[ 103.600047][ T5460] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.603017][ T5460] CPU: 0 UID: 0 PID: 5460 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 103.606657][ T5460] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 103.611048][ T5460] Call Trace:
[ 103.612616][ T5460]
[ 103.614066][ T5460] dump_stack_lvl+0x99/0x250
[ 103.616545][ T5460] ? __asan_memcpy+0x40/0x70
[ 103.618995][ T5460] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.621616][ T5460] ? __pfx__printk+0x10/0x10
[ 103.623534][ T5460] vpanic+0x237/0x6d0
[ 103.625333][ T5460] ? __pfx_vpanic+0x10/0x10
[ 103.627386][ T5460] panic+0xb9/0xc0
[ 103.629076][ T5460] ? __pfx_panic+0x10/0x10
[ 103.631047][ T5460] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.633629][ T5460] ? is_module_address+0x17/0xf0
[ 103.635807][ T5460] ? copy_to_urb+0x261/0x460
[ 103.637912][ T5460] check_panic_on_warn+0x89/0xb0
[ 103.640128][ T5460] ? copy_to_urb+0x261/0x460
[ 103.642019][ T5460] end_report+0x78/0x160
[ 103.643926][ T5460] kasan_report+0x129/0x150
[ 103.645855][ T5460] ? copy_to_urb+0x261/0x460
[ 103.648264][ T5460] kasan_check_range+0x2b0/0x2c0
[ 103.650791][ T5460] ? copy_to_urb+0x261/0x460
[ 103.652925][ T5460] __asan_memcpy+0x40/0x70
[ 103.654909][ T5460] copy_to_urb+0x261/0x460
[ 103.656868][ T5460] ? __kernel_text_address+0xd/0x40
[ 103.659104][ T5460] prepare_playback_urb+0x953/0x13d0
[ 103.661298][ T5460] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.663937][ T5460] ? lockdep_unlock+0x89/0x120
[ 103.666019][ T5460] ? validate_chain+0x897/0x2140
[ 103.668125][ T5460] ? __pfx_prepare_playback_urb+0x10/0x10
[ 103.670519][ T5460] prepare_outbound_urb+0x377/0xc50
[ 103.672830][ T5460] ? _copy_from_iter+0xc3d/0x1790
[ 103.675082][ T5460] ? __asan_memcpy+0x40/0x70
[ 103.677050][ T5460] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 103.679600][ T5460] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 103.682269][ T5460] snd_usb_endpoint_start+0x4d8/0x14a0
[ 103.684539][ T5460] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 103.686852][ T5460] ? do_raw_spin_lock+0x121/0x290
[ 103.688818][ T5460] start_endpoints+0xa1/0x280
[ 103.690704][ T5460] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 103.693319][ T5460] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 103.695868][ T5460] snd_pcm_do_start+0xb7/0x180
[ 103.697793][ T5460] snd_pcm_action+0xe7/0x240
[ 103.699802][ T5460] __snd_pcm_lib_xfer+0x1762/0x1ce0
[ 103.701994][ T5460] ? __pfx_interleaved_copy+0x10/0x10
[ 103.704152][ T5460] ? __pfx_default_write_copy+0x10/0x10
[ 103.706412][ T5460] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 103.708823][ T5460] snd_pcm_oss_write3+0x1bc/0x320
[ 103.710847][ T5460] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 103.713350][ T5460] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 103.715950][ T5460] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 103.718642][ T5460] snd_pcm_oss_write+0xb9c/0x1190
[ 103.720742][ T5460] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.723105][ T5460] ? bpf_lsm_file_permission+0x9/0x20
[ 103.725458][ T5460] ? security_file_permission+0x75/0x290
[ 103.727713][ T5460] ? rw_verify_area+0x255/0x4d0
[ 103.729678][ T5460] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 103.731952][ T5460] vfs_write+0x27e/0xb30
[ 103.733803][ T5460] ? __pfx_vfs_write+0x10/0x10
[ 103.735894][ T5460] ? __pfx_do_futex+0x10/0x10
[ 103.737970][ T5460] ksys_write+0x145/0x250
[ 103.739868][ T5460] ? __pfx_ksys_write+0x10/0x10
[ 103.741997][ T5460] ? do_syscall_64+0xbe/0xfa0
[ 103.744058][ T5460] do_syscall_64+0xfa/0xfa0
[ 103.745926][ T5460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.748524][ T5460] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 103.751112][ T5460] ? clear_bhb_loop+0x60/0xb0
[ 103.753278][ T5460] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.755912][ T5460] RIP: 0033:0x7fc20d38efc9
[ 103.757854][ T5460] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 103.765770][ T5460] RSP: 002b:00007ffde4421438 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 103.768877][ T5460] RAX: ffffffffffffffda RBX: 00007fc20d5e5fa0 RCX: 00007fc20d38efc9
[ 103.771869][ T5460] RDX: 00000000000005ce RSI: 0000200000000e00 RDI: 0000000000000004
[ 103.774882][ T5460] RBP: 00007fc20d411f91 R08: 0000000000000000 R09: 0000000000000000
[ 103.777869][ T5460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.781198][ T5460] R13: 00007fc20d5e5fa0 R14: 00007fc20d5e5fa0 R15: 0000000000000003
[ 103.784530][ T5460]
[ 103.786150][ T5460] Kernel Offset: disabled
[ 103.787988][ T5460] Rebooting in 86400 seconds..
VM DIAGNOSIS:
16:20:27 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002a5eab0
R8 =ffff888033610237 R9 =1ffff110066c2046 R10=dffffc0000000000 R11=ffffffff85166e20
R12=dffffc0000000000 R13=ffffffff997e2920 R14=ffffffff99af6320 R15=0000000000000000
RIP=ffffffff85166e9c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055557e4ac500 ffffffff 00c00000
GS =0000 ffff88808d732000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000001000 CR3=0000000000b27000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fffff800 Opmask01=0000000000000014 Opmask02=000000000000003f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffde441f370 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc20d412fdb
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc20d412fe8
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc20d412fe2
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc20d412ff6
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc20d41307c
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc20d41315a
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 2323232323232323 2323232323232323
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000336f69 6475000500060006
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000104c4a 4756420c5546470c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000060
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000