[ 38.430104][ T1415] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.489716][ T1415] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.570762][ T1415] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.711763][ T1415] bridge_slave_1: left allmulticast mode [ 38.711794][ T1415] bridge_slave_1: left promiscuous mode [ 38.711885][ T1415] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.716419][ T1415] bridge_slave_0: left allmulticast mode [ 38.717778][ T1415] bridge_slave_0: left promiscuous mode [ 38.718952][ T1415] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.767508][ T1415] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.798128][ T1415] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.847511][ T1415] bond0 (unregistering): Released all slaves [ 38.961758][ T4400] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.072889][ T4400] 8021q: adding VLAN 0 to HW filter on device eth1 [ 39.152766][ T1415] hsr_slave_0: left promiscuous mode [ 39.153976][ T1415] hsr_slave_1: left promiscuous mode [ 39.154435][ T1415] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.154447][ T1415] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.156634][ T1415] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.156647][ T1415] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.160701][ T1415] veth1_macvtap: left promiscuous mode [ 39.160726][ T1415] veth0_macvtap: left promiscuous mode [ 39.160769][ T1415] veth1_vlan: left promiscuous mode [ 39.160801][ T1415] veth0_vlan: left promiscuous mode [ 39.254477][ T1415] team0 (unregistering): Port device team_slave_1 removed [ 39.260802][ T1415] team0 (unregistering): Port device team_slave_0 removed [ 39.304670][ T4400] 8021q: adding VLAN 0 to HW filter on device eth2 [ 39.414727][ T4400] 8021q: adding VLAN 0 to HW filter on device eth3 Warning: Permanently added '10.128.1.8' (ED25519) to the list of known hosts. 1970/01/01 00:00:42 parsed 1 programs [ 43.926367][ T5020] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 47.921810][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.921836][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.929345][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.929368][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.966449][ T4736] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.967707][ T4736] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.968385][ T4736] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.968714][ T4736] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.968945][ T4736] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 48.566087][ T5064] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.566162][ T5064] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.566214][ T5064] bridge_slave_0: entered allmulticast mode [ 48.566639][ T5064] bridge_slave_0: entered promiscuous mode [ 48.568406][ T5064] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.568453][ T5064] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.568496][ T5064] bridge_slave_1: entered allmulticast mode [ 48.568885][ T5064] bridge_slave_1: entered promiscuous mode [ 48.581301][ T5064] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.582225][ T5064] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.591999][ T5064] team0: Port device team_slave_0 added [ 48.594030][ T5064] team0: Port device team_slave_1 added [ 48.605516][ T5064] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.605536][ T5064] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.605551][ T5064] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.606032][ T5064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.606039][ T5064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.606053][ T5064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.624570][ T5064] hsr_slave_0: entered promiscuous mode [ 48.624836][ T5064] hsr_slave_1: entered promiscuous mode [ 48.988050][ T5064] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.990920][ T5064] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.992794][ T5064] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.995062][ T5064] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.997033][ T5064] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.999257][ T5064] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.001129][ T5064] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.003230][ T5064] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.026094][ T5064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.031154][ T5064] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.034117][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.034166][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.039725][ T1415] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.039769][ T1415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.146851][ T5064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.154389][ T5064] veth0_vlan: entered promiscuous mode [ 49.156273][ T5064] veth1_vlan: entered promiscuous mode [ 49.164489][ T5064] veth0_macvtap: entered promiscuous mode [ 49.168167][ T5064] veth1_macvtap: entered promiscuous mode [ 49.171386][ T5064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.172331][ T5064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.176109][ T1415] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.178636][ T1415] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.178657][ T1415] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.207511][ T1415] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.283652][ T1415] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.332533][ T1415] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.393626][ T1415] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.445404][ T1415] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:49 executed programs: 0 [ 49.907183][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 49.907533][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 49.907695][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 49.908011][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 49.908218][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 50.043041][ T5234] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.043117][ T5234] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.043173][ T5234] bridge_slave_0: entered allmulticast mode [ 50.043652][ T5234] bridge_slave_0: entered promiscuous mode [ 50.044530][ T5234] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.044578][ T5234] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.045162][ T5234] bridge_slave_1: entered allmulticast mode [ 50.045556][ T5234] bridge_slave_1: entered promiscuous mode [ 50.059411][ T5234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.060326][ T5234] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.068924][ T5234] team0: Port device team_slave_0 added [ 50.069707][ T5234] team0: Port device team_slave_1 added [ 50.076442][ T5234] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.076467][ T5234] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.076480][ T5234] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.077490][ T5234] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.077497][ T5234] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.077510][ T5234] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.094771][ T5234] hsr_slave_0: entered promiscuous mode [ 50.095102][ T5234] hsr_slave_1: entered promiscuous mode [ 50.095282][ T5234] debugfs: 'hsr0' already exists in 'hsr' [ 50.095292][ T5234] Cannot create hsr debugfs directory [ 51.926915][ T4736] Bluetooth: hci0: command tx timeout [ 52.890091][ T1415] bridge_slave_1: left allmulticast mode [ 52.890122][ T1415] bridge_slave_1: left promiscuous mode [ 52.890220][ T1415] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.894871][ T1415] bridge_slave_0: left allmulticast mode [ 52.895969][ T1415] bridge_slave_0: left promiscuous mode [ 52.897316][ T1415] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.949501][ T1415] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 52.965762][ T1415] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 52.977641][ T1415] bond0 (unregistering): Released all slaves [ 53.006291][ T4400] 8021q: adding VLAN 0 to HW filter on device eth0 [ 53.029685][ T1415] hsr_slave_0: left promiscuous mode [ 53.031052][ T1415] hsr_slave_1: left promiscuous mode [ 53.031644][ T1415] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 53.031660][ T1415] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 53.032667][ T1415] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 53.032678][ T1415] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 53.038538][ T1415] veth1_macvtap: left promiscuous mode [ 53.038582][ T1415] veth0_macvtap: left promiscuous mode [ 53.038791][ T1415] veth1_vlan: left promiscuous mode [ 53.038825][ T1415] veth0_vlan: left promiscuous mode [ 53.133275][ T1415] team0 (unregistering): Port device team_slave_1 removed [ 53.138256][ T1415] team0 (unregistering): Port device team_slave_0 removed [ 53.182946][ T4400] 8021q: adding VLAN 0 to HW filter on device eth1 [ 53.411969][ T5234] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 53.413646][ T5234] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 53.414047][ T5234] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 53.415632][ T5234] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 53.416055][ T5234] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 53.418029][ T5234] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 53.418407][ T5234] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 53.420162][ T5234] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 53.533986][ T5234] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.541052][ T5234] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.542676][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.542719][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.555562][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.555609][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.699595][ T5234] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.710919][ T5234] veth0_vlan: entered promiscuous mode [ 53.712537][ T5234] veth1_vlan: entered promiscuous mode [ 53.719262][ T5234] veth0_macvtap: entered promiscuous mode [ 53.722947][ T5234] veth1_macvtap: entered promiscuous mode [ 53.726537][ T5234] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.730829][ T5234] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.755481][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.755507][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.763566][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.765057][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.766987][ T1415] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.788306][ T1415] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.788503][ T1415] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.788621][ T1415] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.006741][ T4736] Bluetooth: hci0: command tx timeout [ 54.036947][ T26] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 54.197380][ T26] usb 1-1: New USB device found, idVendor=eb1a, idProduct=e303, bcdDevice=fc.a0 [ 54.198388][ T26] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 54.198400][ T26] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 54.199857][ T26] usb 1-1: New USB device strings: Mfr=214, Product=33, SerialNumber=3 [ 54.199868][ T26] usb 1-1: Product: syz [ 54.199875][ T26] usb 1-1: Manufacturer: syz [ 54.199881][ T26] usb 1-1: SerialNumber: syz [ 54.201602][ T26] usb 1-1: config 0 descriptor?? [ 54.206207][ T26] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (eb1a:e303, interface 0, class 0) [ 54.206224][ T26] em28xx 1-1:0.0: Video interface 0 found: bulk [ 54.466906][ T26] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 54.573498][ T26] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 54.573530][ T26] em28xx 1-1:0.0: board has no eeprom [ 54.626717][ T26] em28xx 1-1:0.0: Identified as Kaiomy TVnPC U2 (card=63) [ 54.626739][ T26] em28xx 1-1:0.0: analog set to bulk mode. [ 54.627638][ T4472] em28xx 1-1:0.0: Registering V4L2 extension [ 54.634199][ T26] usb 1-1: USB disconnect, device number 2 [ 54.634862][ T26] em28xx 1-1:0.0: Disconnecting em28xx [ 54.651081][ T4472] i2c i2c-1: Invalid 7-bit I2C address 0x00 [ 54.659142][ T4472] tuner: 1-0061: Tuner -1 found with type(s) Radio TV. [ 54.659686][ T4472] xc2028 1-0061: creating new instance [ 54.659696][ T4472] xc2028 1-0061: type set to XCeive xc2028/xc3028 tuner [ 54.659818][ T4472] em28xx 1-1:0.0: Config register raw data: 0xffffffed [ 54.659827][ T4472] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 54.659833][ T4472] em28xx 1-1:0.0: No AC97 audio processor [ 54.661994][ T4472] em28xx 1-1:0.0: Registered radio device as radio2 [ 54.662015][ T4472] usb 1-1: Decoder not found [ 54.662023][ T4472] em28xx 1-1:0.0: failed to create media graph [ 54.662041][ T4472] em28xx 1-1:0.0: V4L2 device radio2 deregistered [ 54.663002][ T4472] em28xx 1-1:0.0: V4L2 device video11 deregistered [ 54.664085][ T4472] xc2028 1-0061: destroying instance [ 54.664912][ T4472] em28xx 1-1:0.0: Registering input extension [ 54.665388][ T26] em28xx 1-1:0.0: Closing input extension [ 54.669309][ T26] em28xx 1-1:0.0: Freeing device [ 54.676458][ T4 ** replaying previous printk message ** [ 54.676458][ T4472] usb 1-1:0.0: Direct firmware load for xc3028-v27.fw failed with error -2 [ 54.676488][ T4472] usb 1-1:0.0: Falling back to sysfs fallback for: xc3028-v27.fw [ 54.676635][ T4472] kobject: kobject_add_internal failed for firmware (error: -2 parent: 1-1:0.0) [ 54.676718][ T4472] firmware xc3028-v27.fw: fw_load_sysfs_fallback: device_register failed [ 54.676759][ T4472] ================================================================== [ 54.676766][ T4472] BUG: KASAN: slab-use-after-free in load_firmware_cb+0xa0/0x1620 [ 54.676785][ T4472] Read of size 8 at addr ffff0000dbb86318 by task kworker/1:3/4472 [ 54.676791][ T4472] [ 54.676795][ T4472] CPU: 1 UID: 0 PID: 4472 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT [ 54.676804][ T4472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 54.676808][ T4472] Workqueue: events request_firmware_work_func [ 54.676821][ T4472] Call trace: [ 54.676824][ T4472] show_stack+0x2c/0x3c (C) [ 54.676836][ T4472] __dump_stack+0x30/0x40 [ 54.676846][ T4472] dump_stack_lvl+0xd8/0x12c [ 54.676855][ T4472] print_address_description+0xb0/0x238 [ 54.676863][ T4472] print_report+0x68/0x84 [ 54.676870][ T4472] kasan_report+0x8c/0xc4 [ 54.676879][ T4472] __asan_report_load8_noabort+0x20/0x2c [ 54.676889][ T4472] load_firmware_cb+0xa0/0x1620 [ 54.676898][ T4472] request_firmware_work_func+0xe8/0x24c [ 54.676907][ T4472] process_scheduled_works+0x788/0x10b8 [ 54.676922][ T4472] worker_thread+0x798/0xbd0 [ 54.676931][ T4472] kthread+0x304/0x3d4 [ 54.676938][ T4472] ret_from_fork+0x10/0x20 [ 54.676945][ T4472] [ 54.676947][ T4472] Allocated by task 4472: [ 54.676951][ T4472] kasan_save_track+0x40/0x78 [ 54.676958][ T4472] kasan_save_alloc_info+0x40/0x50 [ 54.676966][ T4472] __kasan_kmalloc+0x9c/0xb4 [ 54.676973][ T4472] __kmalloc_cache_noprof+0x2e8/0x5ec [ 54.676980][ T4472] tuner_probe+0xc8/0x124c [ 54.676987][ T4472] i2c_device_probe+0x848/0x9d4 [ 54.676994][ T4472] really_probe+0x29c/0x800 [ 54.677002][ T4472] __driver_probe_device+0x1e0/0x350 [ 54.677010][ T4472] driver_probe_device+0x6c/0x19c [ 54.677018][ T4472] __device_attach_driver+0x198/0x2f8 [ 54.677026][ T4472] bus_for_each_drv+0x144/0x1dc [ 54.677033][ T4472] __device_attach+0x248/0x390 [ 54.677040][ T4472] device_initial_probe+0x90/0xc8 [ 54.677048][ T4472] bus_probe_device+0x58/0x120 [ 54.677054][ T4472] device_add+0x6cc/0x9e0 [ 54.677060][ T4472] device_register+0x28/0x38 [ 54.677068][ T4472] i2c_new_client_device+0x5ac/0xadc [ 54.677075][ T4472] v4l2_i2c_new_subdev_board+0xa8/0x218 [ 54.677081][ T4472] v4l2_i2c_new_subdev+0x144/0x1d4 [ 54.677086][ T4472] em28xx_v4l2_init+0x6a8/0x24e8 [ 54.677094][ T4472] em28xx_init_extension+0x10c/0x1b4 [ 54.677100][ T4472] request_module_async+0x68/0x98 [ 54.677107][ T4472] process_scheduled_works+0x788/0x10b8 [ 54.677113][ T4472] worker_thread+0x798/0xbd0 [ 54.677120][ T4472] kthread+0x304/0x3d4 [ 54.677126][ T4472] ret_from_fork+0x10/0x20 [ 54.677131][ T4472] [ 54.677132][ T4472] Freed by task 4472: [ 54.677135][ T4472] kasan_save_track+0x40/0x78 [ 54.677142][ T4472] kasan_save_free_info+0x54/0x6c [ 54.677149][ T4472] __kasan_slab_free+0x74/0xa4 [ 54.677156][ T4472] kfree+0x188/0x690 [ 54.677162][ T4472] tuner_remove+0x140/0x15c [ 54.677168][ T4472] i2c_device_remove+0x8c/0x1f8 [ 54.677175][ T4472] device_remove+0xc4/0x134 [ 54.677182][ T4472] device_release_driver_internal+0x124/0x20c [ 54.677191][ T4472] device_release_driver+0x28/0x38 [ 54.677198][ T4472] bus_remove_device+0x2d0/0x400 [ 54.677205][ T4472] device_del+0x3ec/0x71c [ 54.677210][ T4472] device_unregister+0x2c/0xf0 [ 54.677216][ T4472] i2c_unregister_device+0x1a8/0x1fc [ 54.677223][ T4472] v4l2_i2c_subdev_unregister+0x68/0x78 [ 54.677228][ T4472] v4l2_device_unregister+0x184/0x228 [ 54.677234][ T4472] em28xx_v4l2_init+0xfc8/0x24e8 [ 54.677241][ T4472] em28xx_init_extension+0x10c/0x1b4 [ 54.677247][ T4472] request_module_async+0x68/0x98 [ 54.677254][ T4472] process_scheduled_works+0x788/0x10b8 [ 54.677260][ T4472] worker_thread+0x798/0xbd0 [ 54.677267][ T4472] kthread+0x304/0x3d4 [ 54.677272][ T4472] ret_from_fork+0x10/0x20 [ 54.677277][ T4472] [ 54.677279][ T4472] The buggy address belongs to the object at ffff0000dbb86000 [ 54.677279][ T4472] which belongs to the cache kmalloc-2k of size 2048 [ 54.677284][ T4472] The buggy address is located 792 bytes inside of [ 54.677284][ T4472] freed 2048-byte region [ffff0000dbb86000, ffff0000dbb86800) [ 54.677291][ T4472] [ 54.677293][ T4472] The buggy address belongs to the physical page: [ 54.677297][ T4472] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bb80 [ 54.677303][ T4472] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 54.677308][ T4472] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 54.677316][ T4472] page_type: f5(slab) [ 54.677323][ T4472] raw: 05ffc00000000040 ffff0000c0002000 dead000000000100 dead000000000122 [ 54.677329][ T4472] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 54.677334][ T4472] head: 05ffc00000000040 ffff0000c0002000 dead000000000100 dead000000000122 [ 54.677340][ T4472] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 54.677345][ T4472] head: 05ffc00000000003 fffffdffc36ee001 00000000ffffffff 00000000ffffffff [ 54.677350][ T4472] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 54.677353][ T4472] page dumped because: kasan: bad access detected [ 54.677356][ T4472] [ 54.677357][ T4472] Memory state around the buggy address: [ 54.677361][ T4472] ffff0000dbb86200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.677365][ T4472] ffff0000dbb86280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.677369][ T4472] >ffff0000dbb86300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.677372][ T4472] ^ [ 54.677375][ T4472] ffff0000dbb86380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.677379][ T4472] ffff0000dbb86400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.677382][ T4472] ================================================================== [ 54.677389][ T4472] Disabling lock debugging due to kernel taint [ 54.677401][ T4472] Unable to handle kernel paging request at virtual address dfff800000000005 [ 54.677406][ T4472] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 54.677411][ T4472] Mem abort info: [ 54.677413][ T4472] ESR = 0x0000000096000005 [ 54.677417][ T4472] EC = 0x25: DABT (current EL), IL = 32 bits [ 54.677421][ T4472] SET = 0, FnV = 0 [ 54.677425][ T4472] EA = 0, S1PTW = 0 [ 54.677428][ T4472] FSC = 0x05: level 1 translation fault [ 54.677432][ T4472] Data abort info: [ 54.677434][ T4472] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 54.677438][ T4472] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 54.677443][ T4472] GCS = 0, Overlay = 0, DirtyBit = 0 [ 54.677447][ T4472] [dfff800000000005] address between user and kernel address ranges [ 54.677453][ T4472] Internal error: Oops: 0000000096000005 [#1] SMP [ 54.792179][ T4472] Modules linked in: [ 54.792861][ T4472] CPU: 1 UID: 0 PID: 4472 Comm: kworker/1:3 Tainted: G B syzkaller #0 PREEMPT [ 54.794675][ T4472] Tainted: [B]=BAD_PAGE [ 54.795395][ T4472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 54.797141][ T4472] Workqueue: events request_firmware_work_func [ 54.798219][ T4472] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 54.799531][ T4472] pc : load_firmware_cb+0x244/0x1620 [ 54.800391][ T4472] lr : load_firmware_cb+0xc0/0x1620 [ 54.801281][ T4472] sp : ffff800094f67960 [ 54.802004][ T4472] x29: ffff800094f67aa0 x28: 1fffe00019cd4090 x27: 0000000000000000 [ 54.803466][ T4472] x26: ffff7000129ecf40 x25: 0000000000000000 x24: ffff800094f67a00 [ 54.804902][ T4472] x23: 1fffe0001b770c63 x22: dfff800000000000 x21: dfff800000000000 [ 54.806269][ T4472] x20: ffff0000dbb86318 x19: 0000000000000000 x18: 00000000ffffffff [ 54.807669][ T4472] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 54.809070][ T4472] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 [ 54.810532][ T4472] x11: 0000000000000000 x10: ffff70001146771d x9 : 0000000000000000 [ 54.812042][ T4472] x8 : 0000000000000005 x7 : 0000000000000000 x6 : ffff80008048c60c [ 54.813511][ T4472] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008398bc74 [ 54.814870][ T4472] x2 : 0000000000000000 x1 : ffff0000ce6a0000 x0 : 0000000000000000 [ 54.816234][ T4472] Call trace: [ 54.816785][ T4472] load_firmware_cb+0x244/0x1620 (P) [ 54.817704][ T4472] request_firmware_work_func+0xe8/0x24c [ 54.818644][ T4472] process_scheduled_works+0x788/0x10b8 [ 54.819583][ T4472] worker_thread+0x798/0xbd0 [ 54.820351][ T4472] kthread+0x304/0x3d4 [ 54.821060][ T4472] ret_from_fork+0x10/0x20 [ 54.821846][ T4472] Code: f2fbfff6 b5fff47b 9100a328 d343fd08 (38766908) [ 54.823041][ T4472] ---[ end trace 0000000000000000 ]--- 1970/01/01 00:00:54 executed programs: 3 [ 55.074774][ T4472] Kernel panic - not syncing: Oops: Fatal exception [ 55.075933][ T4472] SMP: stopping secondary CPUs [ 55.076772][ T4472] Kernel Offset: disabled [ 55.077514][ T4472] CPU features: 0x14000000,003c0008,27020a02,a84ff6a7 [ 55.078697][ T4472] Memory Limit: none [ 55.326629][ T4472] Rebooting in 86400 seconds..