Warning: Permanently added '[localhost]:10665' (ED25519) to the list of known hosts.
2025/11/01 19:47:24 parsed 1 programs
syzkaller login: [ 89.711525][ T5312] cgroup: Unknown subsys name 'net'
[ 89.781047][ T5312] cgroup: Unknown subsys name 'cpuset'
[ 89.787108][ T5312] cgroup: Unknown subsys name 'rlimit'
[ 91.473992][ T5312] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 92.037129][ T9] cfg80211: failed to load regulatory.db
[ 96.004064][ T5326] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 99.453485][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.457926][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 99.463620][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 99.467523][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 99.470712][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 99.980984][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.984509][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.017234][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.020641][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.191466][ T5390] chnl_net:caif_netlink_parms(): no params data found
[ 101.329480][ T5390] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.333517][ T5390] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.337511][ T5390] bridge_slave_0: entered allmulticast mode
[ 101.345494][ T5390] bridge_slave_0: entered promiscuous mode
[ 101.352107][ T5390] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.355231][ T5390] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.359003][ T5390] bridge_slave_1: entered allmulticast mode
[ 101.362851][ T5390] bridge_slave_1: entered promiscuous mode
[ 101.387389][ T5390] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 101.393706][ T5390] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 101.418747][ T5390] team0: Port device team_slave_0 added
[ 101.423469][ T5390] team0: Port device team_slave_1 added
[ 101.446386][ T5390] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 101.449936][ T5390] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.461700][ T5390] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 101.469308][ T5390] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 101.472333][ T5390] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.484534][ T5390] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 101.519938][ T5390] hsr_slave_0: entered promiscuous mode
[ 101.523481][ T5390] hsr_slave_1: entered promiscuous mode
[ 101.668634][ T5390] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 101.680700][ T5390] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 101.688010][ T5390] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 101.694243][ T5390] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 101.724603][ T5390] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.728072][ T5390] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 101.732049][ T5390] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.735320][ T5390] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 101.800379][ T5390] 8021q: adding VLAN 0 to HW filter on device bond0
[ 101.813660][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.819765][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.831627][ T5390] 8021q: adding VLAN 0 to HW filter on device team0
[ 101.842746][ T1135] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.846065][ T1135] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 101.859036][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.862383][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 102.044803][ T5390] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 102.084530][ T5390] veth0_vlan: entered promiscuous mode
[ 102.093405][ T5390] veth1_vlan: entered promiscuous mode
[ 102.122090][ T5390] veth0_macvtap: entered promiscuous mode
[ 102.132216][ T5390] veth1_macvtap: entered promiscuous mode
[ 102.149335][ T5390] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 102.160143][ T5390] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 102.171345][ T1135] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.175336][ T1135] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.189495][ T1135] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.202481][ T1135] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.350420][ T1135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.399203][ T1135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.450107][ T1135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.553164][ T1135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/01 19:47:40 executed programs: 0
[ 103.398927][ T4667] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 103.402873][ T4667] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 103.406439][ T4667] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 103.412234][ T4667] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 103.415735][ T4667] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 103.574689][ T5420] chnl_net:caif_netlink_parms(): no params data found
[ 103.665779][ T5420] bridge0: port 1(bridge_slave_0) entered blocking state
[ 103.669750][ T5420] bridge0: port 1(bridge_slave_0) entered disabled state
[ 103.672732][ T5420] bridge_slave_0: entered allmulticast mode
[ 103.676253][ T5420] bridge_slave_0: entered promiscuous mode
[ 103.682114][ T5420] bridge0: port 2(bridge_slave_1) entered blocking state
[ 103.685300][ T5420] bridge0: port 2(bridge_slave_1) entered disabled state
[ 103.688626][ T5420] bridge_slave_1: entered allmulticast mode
[ 103.691877][ T5420] bridge_slave_1: entered promiscuous mode
[ 103.718852][ T5420] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 103.725094][ T5420] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 103.748420][ T5420] team0: Port device team_slave_0 added
[ 103.753000][ T5420] team0: Port device team_slave_1 added
[ 103.783583][ T5420] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 103.786641][ T5420] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 103.817352][ T5420] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 103.828437][ T5420] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 103.831356][ T5420] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 103.857413][ T5420] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 103.928739][ T5420] hsr_slave_0: entered promiscuous mode
[ 103.937296][ T5420] hsr_slave_1: entered promiscuous mode
[ 103.948014][ T5420] debugfs: 'hsr0' already exists in 'hsr'
[ 103.950557][ T5420] Cannot create hsr debugfs directory
[ 105.205604][ T1135] bridge_slave_1: left allmulticast mode
[ 105.211081][ T1135] bridge_slave_1: left promiscuous mode
[ 105.214404][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.230360][ T1135] bridge_slave_0: left allmulticast mode
[ 105.232787][ T1135] bridge_slave_0: left promiscuous mode
[ 105.235304][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.468087][ T4667] Bluetooth: hci0: command tx timeout
[ 105.646633][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 105.653094][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 105.658304][ T1135] bond0 (unregistering): Released all slaves
[ 105.724160][ T1135] hsr_slave_0: left promiscuous mode
[ 105.731308][ T1135] hsr_slave_1: left promiscuous mode
[ 105.741983][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 105.745447][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 105.750905][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 105.754107][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 105.765251][ T1135] veth1_macvtap: left promiscuous mode
[ 105.769466][ T1135] veth0_macvtap: left promiscuous mode
[ 105.772205][ T1135] veth1_vlan: left promiscuous mode
[ 105.774597][ T1135] veth0_vlan: left promiscuous mode
[ 106.044822][ T1135] team0 (unregistering): Port device team_slave_1 removed
[ 106.064127][ T1135] team0 (unregistering): Port device team_slave_0 removed
[ 106.652439][ T5420] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 106.782743][ T5420] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 106.803229][ T5420] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 106.824920][ T5420] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 107.037952][ T5420] 8021q: adding VLAN 0 to HW filter on device bond0
[ 107.077662][ T5420] 8021q: adding VLAN 0 to HW filter on device team0
[ 107.092775][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 107.096046][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 107.113223][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 107.116442][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 107.464909][ T5420] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 107.533649][ T5420] veth0_vlan: entered promiscuous mode
[ 107.547995][ T4667] Bluetooth: hci0: command tx timeout
[ 107.554920][ T5420] veth1_vlan: entered promiscuous mode
[ 107.603621][ T5420] veth0_macvtap: entered promiscuous mode
[ 107.624163][ T5420] veth1_macvtap: entered promiscuous mode
[ 107.658841][ T5420] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 107.680667][ T5420] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 107.700093][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.704653][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.712808][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.716350][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.782354][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.785826][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.821038][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.824614][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.116913][ T9] usb 5-1: new full-speed USB device number 2 using dummy_hcd
[ 108.272328][ T9] usb 5-1: config 0 interface 0 has no altsetting 0
[ 108.278480][ T9] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[ 108.282574][ T9] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[ 108.286320][ T9] usb 5-1: Product: syz
[ 108.289490][ T9] usb 5-1: Manufacturer: syz
[ 108.291586][ T9] usb 5-1: SerialNumber: syz
[ 108.307862][ T9] usb 5-1: config 0 descriptor??
[ 108.319647][ T9] usb 5-1: selecting invalid altsetting 0
[ 108.515704][ T5461] ==================================================================
[ 108.519399][ T5461] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460
[ 108.522887][ T5461] Write of size 264 at addr ffff88801107b400 by task syz.0.17/5461
[ 108.527310][ T5461]
[ 108.528435][ T5461] CPU: 0 UID: 0 PID: 5461 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 108.528452][ T5461] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 108.528459][ T5461] Call Trace:
[ 108.528467][ T5461]
[ 108.528472][ T5461] dump_stack_lvl+0x189/0x250
[ 108.528491][ T5461] ? __virt_addr_valid+0x1c8/0x5c0
[ 108.528507][ T5461] ? rcu_is_watching+0x15/0xb0
[ 108.528520][ T5461] ? __pfx_dump_stack_lvl+0x10/0x10
[ 108.528534][ T5461] ? rcu_is_watching+0x15/0xb0
[ 108.528546][ T5461] ? lock_release+0x4b/0x3e0
[ 108.528555][ T5461] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 108.528568][ T5461] ? __virt_addr_valid+0x1c8/0x5c0
[ 108.528581][ T5461] ? __virt_addr_valid+0x4a5/0x5c0
[ 108.528596][ T5461] print_report+0xca/0x240
[ 108.528609][ T5461] ? copy_to_urb+0x261/0x460
[ 108.528624][ T5461] kasan_report+0x118/0x150
[ 108.528640][ T5461] ? copy_to_urb+0x261/0x460
[ 108.528656][ T5461] kasan_check_range+0x2b0/0x2c0
[ 108.528670][ T5461] ? copy_to_urb+0x261/0x460
[ 108.528684][ T5461] __asan_memcpy+0x40/0x70
[ 108.528695][ T5461] copy_to_urb+0x261/0x460
[ 108.528711][ T5461] ? __kernel_text_address+0xd/0x40
[ 108.528727][ T5461] prepare_playback_urb+0x953/0x13d0
[ 108.528747][ T5461] ? __pfx_prepare_playback_urb+0x10/0x10
[ 108.528763][ T5461] ? lockdep_unlock+0x89/0x120
[ 108.528777][ T5461] ? validate_chain+0x897/0x2140
[ 108.528790][ T5461] ? __pfx_prepare_playback_urb+0x10/0x10
[ 108.528813][ T5461] prepare_outbound_urb+0x377/0xc50
[ 108.528826][ T5461] ? _copy_from_iter+0xc3d/0x1790
[ 108.528895][ T5461] ? __asan_memcpy+0x40/0x70
[ 108.528907][ T5461] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 108.528920][ T5461] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 108.528932][ T5461] snd_usb_endpoint_start+0x4d8/0x14a0
[ 108.528948][ T5461] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 108.528960][ T5461] ? do_raw_spin_lock+0x121/0x290
[ 108.528975][ T5461] start_endpoints+0xa1/0x280
[ 108.528989][ T5461] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 108.529005][ T5461] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 108.529022][ T5461] snd_pcm_do_start+0xb7/0x180
[ 108.529035][ T5461] snd_pcm_action+0xe7/0x240
[ 108.529044][ T5461] __snd_pcm_lib_xfer+0x1762/0x1ce0
[ 108.529060][ T5461] ? __pfx_interleaved_copy+0x10/0x10
[ 108.529073][ T5461] ? __pfx_default_write_copy+0x10/0x10
[ 108.529087][ T5461] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 108.529104][ T5461] snd_pcm_oss_write3+0x1bc/0x320
[ 108.529117][ T5461] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 108.529133][ T5461] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 108.529148][ T5461] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 108.529163][ T5461] snd_pcm_oss_write+0xb9c/0x1190
[ 108.529178][ T5461] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 108.529192][ T5461] ? bpf_lsm_file_permission+0x9/0x20
[ 108.529202][ T5461] ? security_file_permission+0x75/0x290
[ 108.529212][ T5461] ? rw_verify_area+0x255/0x4d0
[ 108.529225][ T5461] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 108.529237][ T5461] vfs_write+0x27e/0xb30
[ 108.529251][ T5461] ? __pfx_vfs_write+0x10/0x10
[ 108.529264][ T5461] ? __pfx_do_futex+0x10/0x10
[ 108.529282][ T5461] ksys_write+0x145/0x250
[ 108.529294][ T5461] ? __pfx_ksys_write+0x10/0x10
[ 108.529308][ T5461] ? do_syscall_64+0xbe/0xfa0
[ 108.529322][ T5461] do_syscall_64+0xfa/0xfa0
[ 108.529337][ T5461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.529348][ T5461] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 108.529358][ T5461] ? clear_bhb_loop+0x60/0xb0
[ 108.529369][ T5461] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.529380][ T5461] RIP: 0033:0x7ff91798efc9
[ 108.529392][ T5461] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 108.529401][ T5461] RSP: 002b:00007ffee4c24fc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 108.529414][ T5461] RAX: ffffffffffffffda RBX: 00007ff917be5fa0 RCX: 00007ff91798efc9
[ 108.529422][ T5461] RDX: 00000000000005ce RSI: 0000200000000e00 RDI: 0000000000000004
[ 108.529429][ T5461] RBP: 00007ff917a11f91 R08: 0000000000000000 R09: 0000000000000000
[ 108.529436][ T5461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 108.529442][ T5461] R13: 00007ff917be5fa0 R14: 00007ff917be5fa0 R15: 0000000000000003
[ 108.529452][ T5461]
[ 108.529457][ T5461]
[ 108.711307][ T5461] Allocated by task 5461:
[ 108.713252][ T5461] kasan_save_track+0x3e/0x80
[ 108.715344][ T5461] __kasan_kmalloc+0x93/0xb0
[ 108.717453][ T5461] __kmalloc_noprof+0x411/0x7f0
[ 108.719783][ T5461] snd_usb_endpoint_set_params+0x1610/0x29a0
[ 108.722412][ T5461] snd_usb_hw_params+0xb12/0x1280
[ 108.724655][ T5461] snd_pcm_hw_params+0x89d/0x1d30
[ 108.726811][ T5461] snd_pcm_oss_change_params_locked+0x21cb/0x3e40
[ 108.729677][ T5461] snd_pcm_oss_write+0x2fb/0x1190
[ 108.731866][ T5461] vfs_write+0x27e/0xb30
[ 108.733718][ T5461] ksys_write+0x145/0x250
[ 108.735615][ T5461] do_syscall_64+0xfa/0xfa0
[ 108.737605][ T5461] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.740191][ T5461]
[ 108.741266][ T5461] The buggy address belongs to the object at ffff88801107b400
[ 108.741266][ T5461] which belongs to the cache kmalloc-64 of size 64
[ 108.746961][ T5461] The buggy address is located 0 bytes inside of
[ 108.746961][ T5461] allocated 54-byte region [ffff88801107b400, ffff88801107b436)
[ 108.753742][ T5461]
[ 108.754789][ T5461] The buggy address belongs to the physical page:
[ 108.757567][ T5461] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1107b
[ 108.761620][ T5461] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 108.765044][ T5461] page_type: f5(slab)
[ 108.766986][ T5461] raw: 00fff00000000000 ffff88801a0418c0 ffffea000045fc80 dead000000000005
[ 108.770966][ T5461] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[ 108.774757][ T5461] page dumped because: kasan: bad access detected
[ 108.777648][ T5461] page_owner tracks the page as allocated
[ 108.780031][ T5461] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5341, tgid 5341 (syz-executor), ts 97923846546, free_ts 97738761799
[ 108.788614][ T5461] post_alloc_hook+0x240/0x2a0
[ 108.790735][ T5461] get_page_from_freelist+0x2365/0x2440
[ 108.793207][ T5461] __alloc_frozen_pages_noprof+0x181/0x370
[ 108.796199][ T5461] alloc_pages_mpol+0x232/0x4a0
[ 108.798368][ T5461] allocate_slab+0x96/0x350
[ 108.800336][ T5461] ___slab_alloc+0xe94/0x18a0
[ 108.802296][ T5461] __slab_alloc+0x65/0x100
[ 108.804135][ T5461] __kmalloc_noprof+0x471/0x7f0
[ 108.806335][ T5461] tomoyo_encode+0x28b/0x550
[ 108.808364][ T5461] tomoyo_realpath_from_path+0x58d/0x5d0
[ 108.810896][ T5461] tomoyo_check_open_permission+0x1c1/0x3b0
[ 108.813578][ T5461] security_file_open+0xb1/0x270
[ 108.815874][ T5461] do_dentry_open+0x384/0x13f0
[ 108.817958][ T5461] vfs_open+0x3b/0x340
[ 108.819772][ T5461] path_openat+0x2ee5/0x3830
[ 108.821705][ T5461] do_filp_open+0x1fa/0x410
[ 108.823530][ T5461] page last free pid 5331 tgid 5331 stack trace:
[ 108.826292][ T5461] __free_frozen_pages+0xbc4/0xd30
[ 108.828470][ T5461] vfree+0x25a/0x400
[ 108.830090][ T5461] kcov_close+0x28/0x50
[ 108.831809][ T5461] __fput+0x44c/0xa70
[ 108.833437][ T5461] task_work_run+0x1d4/0x260
[ 108.835278][ T5461] do_exit+0x6b5/0x2300
[ 108.837145][ T5461] do_group_exit+0x21c/0x2d0
[ 108.839254][ T5461] get_signal+0x1285/0x1340
[ 108.841293][ T5461] arch_do_signal_or_restart+0xa0/0x790
[ 108.843840][ T5461] exit_to_user_mode_loop+0x72/0x130
[ 108.846150][ T5461] do_syscall_64+0x2bd/0xfa0
[ 108.848117][ T5461] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.850645][ T5461]
[ 108.851643][ T5461] Memory state around the buggy address:
[ 108.854047][ T5461] ffff88801107b300: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 108.857600][ T5461] ffff88801107b380: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 108.861142][ T5461] >ffff88801107b400: 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc
[ 108.864734][ T5461] ^
[ 108.867309][ T5461] ffff88801107b480: 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc
[ 108.870941][ T5461] ffff88801107b500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 108.874610][ T5461] ==================================================================
[ 108.878247][ T5461] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 108.881539][ T5461] CPU: 0 UID: 0 PID: 5461 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 108.885417][ T5461] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 108.890120][ T5461] Call Trace:
[ 108.891626][ T5461]
[ 108.892961][ T5461] dump_stack_lvl+0x99/0x250
[ 108.895049][ T5461] ? __asan_memcpy+0x40/0x70
[ 108.897197][ T5461] ? __pfx_dump_stack_lvl+0x10/0x10
[ 108.899677][ T5461] ? __pfx__printk+0x10/0x10
[ 108.901854][ T5461] vpanic+0x237/0x6d0
[ 108.903721][ T5461] ? __pfx_vpanic+0x10/0x10
[ 108.905760][ T5461] panic+0xb9/0xc0
[ 108.907432][ T5461] ? __pfx_panic+0x10/0x10
[ 108.909462][ T5461] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 108.912099][ T5461] ? is_module_address+0x17/0xf0
[ 108.914197][ T5461] ? copy_to_urb+0x261/0x460
[ 108.916194][ T5461] check_panic_on_warn+0x89/0xb0
[ 108.918367][ T5461] ? copy_to_urb+0x261/0x460
[ 108.920355][ T5461] end_report+0x78/0x160
[ 108.922133][ T5461] kasan_report+0x129/0x150
[ 108.924066][ T5461] ? copy_to_urb+0x261/0x460
[ 108.925944][ T5461] kasan_check_range+0x2b0/0x2c0
[ 108.928103][ T5461] ? copy_to_urb+0x261/0x460
[ 108.930043][ T5461] __asan_memcpy+0x40/0x70
[ 108.931955][ T5461] copy_to_urb+0x261/0x460
[ 108.933932][ T5461] ? __kernel_text_address+0xd/0x40
[ 108.936210][ T5461] prepare_playback_urb+0x953/0x13d0
[ 108.938612][ T5461] ? __pfx_prepare_playback_urb+0x10/0x10
[ 108.941151][ T5461] ? lockdep_unlock+0x89/0x120
[ 108.943304][ T5461] ? validate_chain+0x897/0x2140
[ 108.945372][ T5461] ? __pfx_prepare_playback_urb+0x10/0x10
[ 108.947816][ T5461] prepare_outbound_urb+0x377/0xc50
[ 108.950094][ T5461] ? _copy_from_iter+0xc3d/0x1790
[ 108.952357][ T5461] ? __asan_memcpy+0x40/0x70
[ 108.954479][ T5461] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 108.957002][ T5461] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 108.959734][ T5461] snd_usb_endpoint_start+0x4d8/0x14a0
[ 108.962169][ T5461] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 108.964758][ T5461] ? do_raw_spin_lock+0x121/0x290
[ 108.966980][ T5461] start_endpoints+0xa1/0x280
[ 108.969261][ T5461] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 108.972115][ T5461] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 108.974936][ T5461] snd_pcm_do_start+0xb7/0x180
[ 108.977018][ T5461] snd_pcm_action+0xe7/0x240
[ 108.979030][ T5461] __snd_pcm_lib_xfer+0x1762/0x1ce0
[ 108.981315][ T5461] ? __pfx_interleaved_copy+0x10/0x10
[ 108.983650][ T5461] ? __pfx_default_write_copy+0x10/0x10
[ 108.986048][ T5461] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 108.988500][ T5461] snd_pcm_oss_write3+0x1bc/0x320
[ 108.990716][ T5461] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 108.993288][ T5461] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 108.996032][ T5461] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 108.999102][ T5461] snd_pcm_oss_write+0xb9c/0x1190
[ 109.001320][ T5461] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 109.003588][ T5461] ? bpf_lsm_file_permission+0x9/0x20
[ 109.005884][ T5461] ? security_file_permission+0x75/0x290
[ 109.008372][ T5461] ? rw_verify_area+0x255/0x4d0
[ 109.010387][ T5461] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 109.012642][ T5461] vfs_write+0x27e/0xb30
[ 109.014454][ T5461] ? __pfx_vfs_write+0x10/0x10
[ 109.016609][ T5461] ? __pfx_do_futex+0x10/0x10
[ 109.018750][ T5461] ksys_write+0x145/0x250
[ 109.020699][ T5461] ? __pfx_ksys_write+0x10/0x10
[ 109.022785][ T5461] ? do_syscall_64+0xbe/0xfa0
[ 109.024862][ T5461] do_syscall_64+0xfa/0xfa0
[ 109.026854][ T5461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.031460][ T5461] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 109.034144][ T5461] ? clear_bhb_loop+0x60/0xb0
[ 109.036209][ T5461] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.038762][ T5461] RIP: 0033:0x7ff91798efc9
[ 109.040794][ T5461] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 109.049084][ T5461] RSP: 002b:00007ffee4c24fc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 109.052714][ T5461] RAX: ffffffffffffffda RBX: 00007ff917be5fa0 RCX: 00007ff91798efc9
[ 109.056155][ T5461] RDX: 00000000000005ce RSI: 0000200000000e00 RDI: 0000000000000004
[ 109.059597][ T5461] RBP: 00007ff917a11f91 R08: 0000000000000000 R09: 0000000000000000
[ 109.063101][ T5461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.067161][ T5461] R13: 00007ff917be5fa0 R14: 00007ff917be5fa0 R15: 0000000000000003
[ 109.070807][ T5461]
[ 109.072499][ T5461] Kernel Offset: disabled
[ 109.074380][ T5461] Rebooting in 86400 seconds..
VM DIAGNOSIS:
19:47:46 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000031 RBX=0000000000000031 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002aeeab0
R8 =ffff8880337c0237 R9 =1ffff110066f8046 R10=dffffc0000000000 R11=ffffffff85166e20
R12=dffffc0000000000 R13=ffffffff997e2951 R14=ffffffff99af6320 R15=0000000000000000
RIP=ffffffff85166e9c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055558455a500 ffffffff 00c00000
GS =0000 ffff88808d732000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000001000 CR3=000000005910e000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fffff800 Opmask01=0000000000000014 Opmask02=000000000000003f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffee4c22f00 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff917a12fdb
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff917a12fe8
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff917a12fe2
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff917a12ff6
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff917a1307c
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff917a1315a
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 2323232323232323 2323232323232323
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000336f69 6475000500060006
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000104c4a 4756420c5546470c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 0000000000000000 0000000000000000 0000000000000098
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000