Warning: Permanently added '10.128.1.69' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://44623 [ 31.735740][ T4340] cgroup: Unknown subsys name 'net' [ 31.932174][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.236379][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 35.789578][ T4370] chnl_net:caif_netlink_parms(): no params data found [ 35.807207][ T4370] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.808576][ T4370] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.810232][ T4370] device bridge_slave_0 entered promiscuous mode [ 35.812471][ T4370] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.813652][ T4370] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.815182][ T4370] device bridge_slave_1 entered promiscuous mode [ 35.821568][ T4370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.823985][ T4370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.832086][ T4370] team0: Port device team_slave_0 added [ 35.833832][ T4370] team0: Port device team_slave_1 added [ 35.838785][ T4370] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.840078][ T4370] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.844380][ T4370] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.846940][ T4370] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.848091][ T4370] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.852976][ T4370] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.900688][ T4370] device hsr_slave_0 entered promiscuous mode [ 35.949786][ T4370] device hsr_slave_1 entered promiscuous mode [ 36.022832][ T4370] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 36.052203][ T4370] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 36.090580][ T4370] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 36.133085][ T4370] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 36.176877][ T4370] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.178124][ T4370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.179657][ T4370] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.180949][ T4370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.197737][ T4370] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.201663][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.203979][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.206000][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.210354][ T4370] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.213505][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.215065][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.216248][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.222360][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.223947][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.225112][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.231054][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 36.233009][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 36.238066][ T4370] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 36.240770][ T4370] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 36.243402][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 36.245100][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.246895][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.248621][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 36.335179][ T4370] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.336791][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 36.338211][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 36.344560][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.351324][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.352901][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.354455][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.356302][ T4370] device veth0_vlan entered promiscuous mode [ 36.359376][ T4370] device veth1_vlan entered promiscuous mode [ 36.367701][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.369211][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.372137][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.374649][ T4370] device veth0_macvtap entered promiscuous mode [ 36.376871][ T4370] device veth1_macvtap entered promiscuous mode [ 36.382583][ T4370] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.383777][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.385893][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.388694][ T4370] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.390549][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.393394][ T4370] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.394833][ T4370] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.396305][ T4370] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.397752][ T4370] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.597640][ T4403] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.601795][ T4403] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.603414][ T4403] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.605258][ T4403] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.606824][ T4403] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.608229][ T4403] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.857976][ T283] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.859289][ T283] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.862911][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.868281][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.870202][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.871571][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:37 executed programs: 0 [ 37.280181][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.281855][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.283383][ T4400] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.285124][ T4400] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.286679][ T4400] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 37.288054][ T4400] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.330342][ T4434] chnl_net:caif_netlink_parms(): no params data found [ 37.348663][ T4434] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.350708][ T4434] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.352252][ T4434] device bridge_slave_0 entered promiscuous mode [ 37.354191][ T4434] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.355525][ T4434] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.357075][ T4434] device bridge_slave_1 entered promiscuous mode [ 37.363699][ T4434] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.366400][ T4434] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.373426][ T4434] team0: Port device team_slave_0 added [ 37.375139][ T4434] team0: Port device team_slave_1 added [ 37.380915][ T4434] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.382077][ T4434] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.386444][ T4434] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.389158][ T4434] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.390485][ T4434] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.394903][ T4434] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.440698][ T4434] device hsr_slave_0 entered promiscuous mode [ 37.489838][ T4434] device hsr_slave_1 entered promiscuous mode [ 37.530103][ T4434] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 37.531546][ T4434] Cannot create hsr debugfs directory [ 37.811631][ T4434] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.369760][ T4403] Bluetooth: hci0: command 0x0409 tx timeout [ 40.870426][ T4434] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.449821][ T4403] Bluetooth: hci0: command 0x041b tx timeout [ 42.011257][ T4434] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.111457][ T4434] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.293324][ T4434] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 42.381425][ T4434] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 42.421443][ T4434] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 42.561589][ T4434] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 42.659071][ T4434] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.662819][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.664492][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.666853][ T4434] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.731947][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.733678][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.735350][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.736602][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.738801][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.741371][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.743001][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.744544][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.745832][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.749020][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.752126][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.754972][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.756568][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.758261][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.761002][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.762726][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.765282][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.766784][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.769319][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.772496][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.822327][ T4434] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.869363][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.871357][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.943373][ T4434] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.948567][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 42.950516][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.956636][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 42.958258][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.960058][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 42.961673][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 42.964083][ T4434] device veth0_vlan entered promiscuous mode [ 42.967155][ T4434] device veth1_vlan entered promiscuous mode [ 42.973707][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 42.975375][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 42.976918][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 42.978603][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.012095][ T4434] device veth0_macvtap entered promiscuous mode [ 43.014477][ T4434] device veth1_macvtap entered promiscuous mode [ 43.019044][ T4434] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 43.021186][ T4434] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.023504][ T4434] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.024813][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 43.026507][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 43.028062][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.029968][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.032657][ T4434] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.034381][ T4434] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.036481][ T4434] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.037772][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.039399][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.043075][ T4434] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.044596][ T4434] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.046319][ T4434] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.047915][ T4434] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.067238][ T283] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.070732][ T283] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.072277][ T283] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 43.077807][ T283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.079200][ T283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.081674][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 43.129460][ T4463] vhci_hcd vhci_hcd.0: remove, state 4 [ 43.130941][ T4463] usb usb3: USB disconnect, device number 1 [ 43.136746][ T4463] vhci_hcd vhci_hcd.0: USB bus 3 deregistered [ 43.136796][ T39] vhci_hcd: stop threads [ 43.138573][ T39] vhci_hcd: release socket [ 43.139342][ T39] vhci_hcd: disconnect device [ 43.141059][ T39] vhci_hcd: stop threads [ 43.141837][ T39] vhci_hcd: release socket [ 43.142055][ T4463] vhci_hcd vhci_hcd.0: remove, state 4 [ 43.142529][ T39] ================================================================== [ 43.143504][ T4463] usb usb2: USB disconnect, device number 1 [ 43.144780][ T39] BUG: KASAN: use-after-free in vhci_cleanup_unlink_list+0x3a8/0x3ac [ 43.147117][ T39] Read of size 4 at addr ffff0000d25e4670 by task kworker/u4:2/39 [ 43.148466][ T39] [ 43.148880][ T39] CPU: 1 PID: 39 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 43.150422][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 43.152346][ T39] Workqueue: usbip_event event_handler [ 43.153304][ T39] Call trace: [ 43.153887][ T39] dump_backtrace+0x1c4/0x1f0 [ 43.154731][ T39] show_stack+0x2c/0x3c [ 43.155709][ T39] __dump_stack+0x30/0x40 [ 43.156462][ T39] dump_stack_lvl+0xf4/0x15c [ 43.157280][ T39] print_address_description+0x88/0x218 [ 43.158199][ T39] print_report+0x50/0x68 [ 43.158920][ T39] kasan_report+0xa8/0xfc [ 43.159631][ T39] __asan_report_load4_noabort+0x2c/0x38 [ 43.160545][ T39] vhci_cleanup_unlink_list+0x3a8/0x3ac [ 43.161473][ T39] vhci_shutdown_connection+0x28c/0x574 [ 43.162405][ T39] event_handler+0x288/0x454 [ 43.163252][ T39] process_one_work+0x7e4/0x13bc [ 43.164112][ T39] worker_thread+0x8cc/0xfe8 [ 43.164903][ T39] kthread+0x254/0x2e0 [ 43.165603][ T39] ret_from_fork+0x10/0x20 [ 43.166382][ T39] [ 43.166796][ T39] Allocated by task 1: [ 43.167516][ T39] kasan_set_track+0x4c/0x80 [ 43.168306][ T39] kasan_save_alloc_info+0x24/0x30 [ 43.169188][ T39] __kasan_kmalloc+0xa0/0xb8 [ 43.169998][ T39] __kmalloc+0xd8/0x180 [ 43.170723][ T39] __usb_create_hcd+0x6c/0x740 [ 43.171559][ T39] usb_create_shared_hcd+0x40/0x54 [ 43.172458][ T39] vhci_hcd_probe+0x1a4/0x354 [ 43.173318][ T39] platform_probe+0x148/0x1c8 [ 43.174127][ T39] really_probe+0x3a0/0xac4 [ 43.174902][ T39] __driver_probe_device+0x1c8/0x368 [ 43.175811][ T39] driver_probe_device+0x78/0x324 [ 43.176694][ T39] __device_attach_driver+0x28c/0x4c0 [ 43.177612][ T39] bus_for_each_drv+0x154/0x1e4 [ 43.178471][ T39] __device_attach+0x2a4/0x3d8 [ 43.179278][ T39] device_initial_probe+0x24/0x34 [ 43.180124][ T39] bus_probe_device+0xbc/0x1c4 [ 43.180972][ T39] device_add+0x93c/0xe4c [ 43.181725][ T39] platform_device_add+0x3f8/0x6f4 [ 43.182574][ T39] vhci_hcd_init+0x390/0x4b0 [ 43.183356][ T39] do_one_initcall+0x278/0x9f0 [ 43.184214][ T39] do_initcall_level+0x158/0x214 [ 43.185058][ T39] do_initcalls+0x58/0xac [ 43.185835][ T39] do_basic_setup+0x8c/0xa0 [ 43.186607][ T39] kernel_init_freeable+0x35c/0x4f0 [ 43.187510][ T39] kernel_init+0x24/0x1d8 [ 43.188252][ T39] ret_from_fork+0x10/0x20 [ 43.189031][ T39] [ 43.189441][ T39] Freed by task 4463: [ 43.190135][ T39] kasan_set_track+0x4c/0x80 [ 43.190957][ T39] kasan_save_free_info+0x38/0x5c [ 43.191863][ T39] ____kasan_slab_free+0x148/0x1b0 [ 43.192759][ T39] __kasan_slab_free+0x18/0x28 [ 43.193558][ T39] slab_free_freelist_hook+0x16c/0x1e8 [ 43.194504][ T39] __kmem_cache_free+0xbc/0x21c [ 43.195372][ T39] kfree+0xd0/0x1a8 [ 43.196059][ T39] usb_put_hcd+0x124/0x16c [ 43.196846][ T39] vhci_hcd_remove+0x98/0x100 [ 43.197705][ T39] platform_remove+0x98/0xf0 [ 43.198563][ T39] device_release_driver_internal+0x3d4/0x6e4 [ 43.199616][ T39] device_driver_detach+0x48/0x58 [ 43.200536][ T39] unbind_store+0x2a8/0x2b4 [ 43.200666][ T4463] vhci_hcd vhci_hcd.0: USB bus 2 deregistered [ 43.201358][ T39] drv_attr_store+0x80/0xa4 [ 43.203275][ T39] sysfs_kf_write+0x1f8/0x274 [ 43.204121][ T39] kernfs_fop_write_iter+0x390/0x4b4 [ 43.205016][ T39] vfs_write+0x3c8/0x7c8 [ 43.205729][ T39] ksys_write+0x12c/0x228 [ 43.206471][ T39] __arm64_sys_write+0x7c/0x90 [ 43.207319][ T39] invoke_syscall+0x98/0x290 [ 43.208132][ T39] el0_svc_common+0x13c/0x258 [ 43.208966][ T39] do_el0_svc+0x5c/0x134 [ 43.209730][ T39] el0_svc+0x58/0x128 [ 43.210377][ T39] el0t_64_sync_handler+0x84/0xf0 [ 43.211237][ T39] el0t_64_sync+0x18c/0x190 [ 43.212017][ T39] [ 43.212415][ T39] The buggy address belongs to the object at ffff0000d25e4000 [ 43.212415][ T39] which belongs to the cache kmalloc-8k of size 8192 [ 43.214885][ T39] The buggy address is located 1648 bytes inside of [ 43.214885][ T39] 8192-byte region [ffff0000d25e4000, ffff0000d25e6000) [ 43.217182][ T39] [ 43.217589][ T39] The buggy address belongs to the physical page: [ 43.218718][ T39] page:00000000fef2e3bb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1125e0 [ 43.220512][ T39] head:00000000fef2e3bb order:3 compound_mapcount:0 compound_pincount:0 [ 43.221963][ T39] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 43.223420][ T39] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002c00 [ 43.224891][ T39] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 43.226340][ T39] page dumped because: kasan: bad access detected [ 43.227400][ T39] [ 43.227800][ T39] Memory state around the buggy address: [ 43.228779][ T39] ffff0000d25e4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.230206][ T39] ffff0000d25e4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.231579][ T39] >ffff0000d25e4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.233227][ T39] ^ [ 43.234865][ T39] ffff0000d25e4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.236584][ T39] ffff0000d25e4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.238147][ T39] ================================================================== [ 43.241874][ T39] Disabling lock debugging due to kernel taint [ 43.242944][ T39] vhci_hcd: disconnect device [ 43.243750][ T39] vhci_hcd: stop threads [ 43.244448][ T39] vhci_hcd: release socket [ 43.245314][ T39] vhci_hcd: disconnect device [ 43.246197][ T39] vhci_hcd: stop threads [ 43.247212][ T39] vhci_hcd: release socket [ 43.248050][ T39] vhci_hcd: disconnect device [ 43.248847][ T39] vhci_hcd: stop threads [ 43.249483][ T39] vhci_hcd: release socket [ 43.250730][ T39] vhci_hcd: disconnect device [ 43.251509][ T39] vhci_hcd: stop threads [ 43.252210][ T39] vhci_hcd: release socket [ 43.252908][ T39] vhci_hcd: disconnect device [ 43.253703][ T39] vhci_hcd: stop threads [ 43.254502][ T39] vhci_hcd: release socket [ 43.255204][ T39] vhci_hcd: disconnect device [ 43.256016][ T39] vhci_hcd: stop threads [ 43.256684][ T39] vhci_hcd: release socket [ 43.257423][ T39] vhci_hcd: disconnect device [ 43.258229][ T39] vhci_hcd: stop threads [ 43.258913][ T39] vhci_hcd: release socket [ 43.259634][ T39] vhci_hcd: disconnect device [ 43.270182][ T39] vhci_hcd: stop threads [ 43.270950][ T39] vhci_hcd: release socket [ 43.271717][ T39] vhci_hcd: disconnect device [ 43.272496][ T39] vhci_hcd: stop threads [ 43.273181][ T39] vhci_hcd: release socket [ 43.273878][ T39] vhci_hcd: disconnect device [ 43.274639][ T39] vhci_hcd: stop threads [ 43.275321][ T39] vhci_hcd: release socket [ 43.276029][ T39] vhci_hcd: disconnect device [ 43.276842][ T39] vhci_hcd: stop threads [ 43.277498][ T39] vhci_hcd: release socket [ 43.278224][ T39] vhci_hcd: disconnect device [ 43.279021][ T39] vhci_hcd: stop threads [ 43.289935][ T39] vhci_hcd: release socket [ 43.290753][ T39] vhci_hcd: disconnect device [ 43.291625][ T39] vhci_hcd: stop threads [ 43.292397][ T39] vhci_hcd: release socket [ 43.293181][ T39] vhci_hcd: disconnect device [ 43.294006][ T39] vhci_hcd: stop threads [ 43.294712][ T39] vhci_hcd: release socket [ 43.295449][ T39] vhci_hcd: disconnect device