Warning: Permanently added '10.128.0.244' (ED25519) to the list of known hosts.
2025/11/24 09:07:38 parsed 1 programs
[ 69.461873][ T5790] cgroup: Unknown subsys name 'net'
[ 69.570552][ T5790] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 70.990997][ T5790] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.508910][ T1279] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.523981][ T1279] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.972578][ T5813] chnl_net:caif_netlink_parms(): no params data found
[ 73.032651][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.040183][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state
[ 73.047399][ T5813] bridge_slave_0: entered allmulticast mode
[ 73.055128][ T5813] bridge_slave_0: entered promiscuous mode
[ 73.066392][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.073480][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state
[ 73.081189][ T5813] bridge_slave_1: entered allmulticast mode
[ 73.088025][ T5813] bridge_slave_1: entered promiscuous mode
[ 73.111569][ T5813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 73.125216][ T5813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 73.151207][ T5813] team0: Port device team_slave_0 added
[ 73.161063][ T5813] team0: Port device team_slave_1 added
[ 73.182605][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 73.189617][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 73.215572][ T5813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 73.228496][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 73.236902][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 73.263131][ T5813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 73.302924][ T5813] hsr_slave_0: entered promiscuous mode
[ 73.309293][ T5813] hsr_slave_1: entered promiscuous mode
[ 73.439681][ T5813] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 73.456720][ T5813] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 73.467596][ T5813] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 73.476515][ T5813] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 73.507061][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.514284][ T5813] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 73.521862][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.529023][ T5813] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 73.578429][ T5813] 8021q: adding VLAN 0 to HW filter on device bond0
[ 73.596250][ T3442] bridge0: port 1(bridge_slave_0) entered disabled state
[ 73.605251][ T3442] bridge0: port 2(bridge_slave_1) entered disabled state
[ 73.624922][ T5813] 8021q: adding VLAN 0 to HW filter on device team0
[ 73.639426][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.646532][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 73.658655][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.665790][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 73.826484][ T5813] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 73.868053][ T5813] veth0_vlan: entered promiscuous mode
[ 73.882458][ T5813] veth1_vlan: entered promiscuous mode
[ 73.910433][ T5813] veth0_macvtap: entered promiscuous mode
[ 73.919493][ T5813] veth1_macvtap: entered promiscuous mode
[ 73.936091][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 73.949583][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 73.961519][ T5813] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 73.971624][ T5813] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 73.980548][ T5813] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 73.989942][ T5813] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.179173][ T3480] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 74.834290][ T5855] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 74.843979][ T5855] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 74.851507][ T5855] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 74.861257][ T5855] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 74.869347][ T5855] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 74.878626][ T5855] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 75.102828][ T3442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.112537][ T3442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.142018][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.150103][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/11/24 09:07:47 executed programs: 0
[ 76.840458][ T5104] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 76.848862][ T5104] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 76.858917][ T5104] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 76.867097][ T5104] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 76.875064][ T5104] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 76.882361][ T5104] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 77.004808][ T3480] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 77.120025][ T5894] chnl_net:caif_netlink_parms(): no params data found
[ 77.195921][ T5894] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.202993][ T5894] bridge0: port 1(bridge_slave_0) entered disabled state
[ 77.210347][ T5894] bridge_slave_0: entered allmulticast mode
[ 77.218110][ T5894] bridge_slave_0: entered promiscuous mode
[ 77.226205][ T5894] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.233309][ T5894] bridge0: port 2(bridge_slave_1) entered disabled state
[ 77.240608][ T5894] bridge_slave_1: entered allmulticast mode
[ 77.247480][ T5894] bridge_slave_1: entered promiscuous mode
[ 77.272077][ T5894] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 77.283316][ T5894] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 77.311441][ T5894] team0: Port device team_slave_0 added
[ 77.319208][ T5894] team0: Port device team_slave_1 added
[ 77.341337][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 77.348369][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.374561][ T5894] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 77.387961][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 77.395341][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.421412][ T5894] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 77.457363][ T5894] hsr_slave_0: entered promiscuous mode
[ 77.463568][ T5894] hsr_slave_1: entered promiscuous mode
[ 77.469806][ T5894] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 77.477656][ T5894] Cannot create hsr debugfs directory
[ 78.945111][ T5104] Bluetooth: hci0: command tx timeout
[ 79.583101][ T3480] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 79.655387][ T3480] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 80.470250][ T3480] hsr_slave_0: left promiscuous mode
[ 80.476378][ T3480] hsr_slave_1: left promiscuous mode
[ 80.482233][ T3480] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 80.489780][ T3480] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 80.497818][ T3480] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 80.505740][ T3480] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 80.513249][ T3480] bridge_slave_1: left allmulticast mode
[ 80.518999][ T3480] bridge_slave_1: left promiscuous mode
[ 80.525119][ T3480] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.535906][ T3480] bridge_slave_0: left allmulticast mode
[ 80.541552][ T3480] bridge_slave_0: left promiscuous mode
[ 80.547535][ T3480] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.566353][ T3480] veth1_macvtap: left promiscuous mode
[ 80.571958][ T3480] veth0_macvtap: left promiscuous mode
[ 80.578382][ T3480] veth1_vlan: left promiscuous mode
[ 80.583715][ T3480] veth0_vlan: left promiscuous mode
[ 80.880287][ T3480] team0 (unregistering): Port device team_slave_1 removed
[ 80.906972][ T3480] team0 (unregistering): Port device team_slave_0 removed
[ 80.932426][ T3480] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 80.962106][ T3480] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 81.024094][ T5104] Bluetooth: hci0: command tx timeout
[ 81.203034][ T3480] bond0 (unregistering): Released all slaves
[ 81.283215][ T5894] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 81.293318][ T5894] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 81.302927][ T5894] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 81.314060][ T5894] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 81.397845][ T5894] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.413566][ T5894] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.437938][ T3442] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.445106][ T3442] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.454366][ T3442] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.461471][ T3442] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.647875][ T5894] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 81.691382][ T5894] veth0_vlan: entered promiscuous mode
[ 81.710971][ T5894] veth1_vlan: entered promiscuous mode
[ 81.754846][ T787] cfg80211: failed to load regulatory.db
[ 81.776895][ T5894] veth0_macvtap: entered promiscuous mode
[ 81.791309][ T5894] veth1_macvtap: entered promiscuous mode
[ 81.829713][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 81.856162][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 81.870527][ T5894] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.879347][ T5894] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.890182][ T5894] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.899957][ T5894] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 82.002653][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 82.013672][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 82.038226][ T3442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 82.046375][ T3442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 82.364300][ T787] usb 1-1: new full-speed USB device number 2 using dummy_hcd
[ 82.548680][ T787] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 4
[ 82.559843][ T787] usb 1-1: config 0 interface 0 has no altsetting 0
[ 82.569355][ T787] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[ 82.578580][ T787] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[ 82.587128][ T787] usb 1-1: Product: syz
[ 82.591316][ T787] usb 1-1: Manufacturer: syz
[ 82.596335][ T787] usb 1-1: SerialNumber: syz
[ 82.608605][ T787] usb 1-1: config 0 descriptor??
[ 82.625661][ T787] usb 1-1: selecting invalid altsetting 0
[ 82.820728][ T5941] ==================================================================
[ 82.828803][ T5941] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x255/0x440
[ 82.836081][ T5941] Write of size 264 at addr ffff88801cf65800 by task syz.0.17/5941
[ 82.843952][ T5941]
[ 82.846269][ T5941] CPU: 0 PID: 5941 Comm: syz.0.17 Not tainted syzkaller #0
[ 82.853475][ T5941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 82.863519][ T5941] Call Trace:
[ 82.866787][ T5941]
[ 82.869712][ T5941] dump_stack_lvl+0x16c/0x230
[ 82.874385][ T5941] ? read_lock_is_recursive+0x20/0x20
[ 82.879743][ T5941] ? show_regs_print_info+0x20/0x20
[ 82.884929][ T5941] ? load_image+0x3b0/0x3b0
[ 82.889418][ T5941] ? _raw_spin_lock_irqsave+0xb4/0xf0
[ 82.894774][ T5941] ? __virt_addr_valid+0x18c/0x540
[ 82.899867][ T5941] ? __virt_addr_valid+0x469/0x540
[ 82.904963][ T5941] print_report+0xac/0x220
[ 82.909367][ T5941] ? copy_to_urb+0x255/0x440
[ 82.913953][ T5941] kasan_report+0x117/0x150
[ 82.918448][ T5941] ? copy_to_urb+0x255/0x440
[ 82.923026][ T5941] kasan_check_range+0x288/0x290
[ 82.927945][ T5941] ? copy_to_urb+0x255/0x440
[ 82.932528][ T5941] __asan_memcpy+0x40/0x70
[ 82.936932][ T5941] copy_to_urb+0x255/0x440
[ 82.941334][ T5941] ? snd_usb_endpoint_next_packet_size+0x333/0x520
[ 82.947821][ T5941] prepare_playback_urb+0x932/0x1360
[ 82.953098][ T5941] ? start_endpoints+0x270/0x270
[ 82.958022][ T5941] ? __lock_acquire+0x7c80/0x7c80
[ 82.963029][ T5941] ? start_endpoints+0x270/0x270
[ 82.967952][ T5941] prepare_outbound_urb+0x372/0xc40
[ 82.973139][ T5941] ? verify_lock_unused+0x140/0x140
[ 82.978317][ T5941] ? __asan_memcpy+0x40/0x70
[ 82.982892][ T5941] ? snd_usb_queue_pending_output_urbs+0xd00/0xd00
[ 82.989374][ T5941] ? _copy_from_iter+0xe60/0x1290
[ 82.994385][ T5941] ? find_vmap_area+0xfc/0x110
[ 82.999131][ T5941] ? snd_usb_endpoint_start_quirk+0x1f7/0x310
[ 83.005183][ T5941] snd_usb_endpoint_start+0x4d9/0x1440
[ 83.010635][ T5941] ? snd_usb_endpoint_get_clock_rate+0x100/0x100
[ 83.016949][ T5941] ? do_raw_spin_lock+0x121/0x2c0
[ 83.021959][ T5941] start_endpoints+0xa1/0x270
[ 83.026629][ T5941] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 83.033207][ T5941] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 83.039612][ T5941] snd_pcm_do_start+0xb1/0x170
[ 83.044361][ T5941] snd_pcm_action+0xda/0x230
[ 83.048934][ T5941] __snd_pcm_lib_xfer+0x16fa/0x1c40
[ 83.054117][ T5941] ? __snd_pcm_lib_xfer+0x1c40/0x1c40
[ 83.059469][ T5941] ? fill_silence+0x240/0x240
[ 83.064129][ T5941] ? __mutex_unlock_slowpath+0x1a2/0x6a0
[ 83.069747][ T5941] ? resample_expand+0x7e4/0x860
[ 83.074668][ T5941] ? pcm_lib_apply_appl_ptr+0x510/0x510
[ 83.080201][ T5941] snd_pcm_oss_write3+0x1bc/0x320
[ 83.085212][ T5941] snd_pcm_plug_write_transfer+0x2b8/0x4a0
[ 83.091000][ T5941] ? __lock_acquire+0x7c80/0x7c80
[ 83.096008][ T5941] ? snd_pcm_plug_client_channels_buf+0x610/0x610
[ 83.102405][ T5941] ? snd_pcm_plug_client_channels_buf+0x46a/0x610
[ 83.108803][ T5941] snd_pcm_oss_write+0xbb5/0x1120
[ 83.113816][ T5941] ? snd_pcm_oss_read+0x8c0/0x8c0
[ 83.118824][ T5941] ? common_file_perm+0x198/0x1f0
[ 83.123831][ T5941] ? fsnotify_perm+0x5d/0x5e0
[ 83.128493][ T5941] ? security_file_permission+0x79/0xa0
[ 83.134024][ T5941] ? snd_pcm_oss_read+0x8c0/0x8c0
[ 83.139030][ T5941] vfs_write+0x288/0x940
[ 83.143257][ T5941] ? file_end_write+0x250/0x250
[ 83.148093][ T5941] ? __ia32_sys_get_robust_list+0x90/0x90
[ 83.153793][ T5941] ? __fdget_pos+0x1d8/0x330
[ 83.158367][ T5941] ksys_write+0x147/0x250
[ 83.162683][ T5941] ? __ia32_sys_read+0x90/0x90
[ 83.167435][ T5941] ? lockdep_hardirqs_on+0x98/0x150
[ 83.172616][ T5941] do_syscall_64+0x55/0xb0
[ 83.177018][ T5941] ? clear_bhb_loop+0x40/0x90
[ 83.181682][ T5941] ? clear_bhb_loop+0x40/0x90
[ 83.186341][ T5941] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 83.192216][ T5941] RIP: 0033:0x7f61c578f749
[ 83.196626][ T5941] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 83.216215][ T5941] RSP: 002b:00007fff33584288 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 83.224616][ T5941] RAX: ffffffffffffffda RBX: 00007f61c59e5fa0 RCX: 00007f61c578f749
[ 83.232568][ T5941] RDX: 00000000000005ce RSI: 0000200000000640 RDI: 0000000000000004
[ 83.240520][ T5941] RBP: 00007f61c5813f91 R08: 0000000000000000 R09: 0000000000000000
[ 83.248472][ T5941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 83.256425][ T5941] R13: 00007f61c59e5fa0 R14: 00007f61c59e5fa0 R15: 0000000000000003
[ 83.264386][ T5941]
[ 83.267387][ T5941]
[ 83.269703][ T5941] Allocated by task 5941:
[ 83.274006][ T5941] kasan_set_track+0x4e/0x70
[ 83.278580][ T5941] __kasan_kmalloc+0x8f/0xa0
[ 83.283148][ T5941] __kmalloc+0xb4/0x240
[ 83.287292][ T5941] snd_usb_endpoint_set_params+0x1575/0x28e0
[ 83.293254][ T5941] snd_usb_hw_params+0x123e/0x19c0
[ 83.298348][ T5941] snd_pcm_hw_params+0x835/0x1c50
[ 83.303353][ T5941] snd_pcm_oss_change_params_locked+0x2144/0x3d30
[ 83.309748][ T5941] snd_pcm_oss_write+0x2ff/0x1120
[ 83.314751][ T5941] vfs_write+0x288/0x940
[ 83.318976][ T5941] ksys_write+0x147/0x250
[ 83.323292][ T5941] do_syscall_64+0x55/0xb0
[ 83.327691][ T5941] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 83.333566][ T5941]
[ 83.335874][ T5941] The buggy address belongs to the object at ffff88801cf65800
[ 83.335874][ T5941] which belongs to the cache kmalloc-128 of size 128
[ 83.349930][ T5941] The buggy address is located 0 bytes inside of
[ 83.349930][ T5941] allocated 120-byte region [ffff88801cf65800, ffff88801cf65878)
[ 83.363879][ T5941]
[ 83.366186][ T5941] The buggy address belongs to the physical page:
[ 83.372581][ T5941] page:ffffea000073d940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1cf65
[ 83.382711][ T5941] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 83.390239][ T5941] page_type: 0xffffffff()
[ 83.394550][ T5941] raw: 00fff00000000800 ffff8880178418c0 dead000000000122 0000000000000000
[ 83.403109][ T5941] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 83.411666][ T5941] page dumped because: kasan: bad access detected
[ 83.418059][ T5941] page_owner tracks the page as allocated
[ 83.423755][ T5941] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5941, tgid 5941 (syz.0.17), ts 82818875675, free_ts 82785078839
[ 83.441617][ T5941] post_alloc_hook+0x1cd/0x210
[ 83.446369][ T5941] get_page_from_freelist+0x195c/0x19f0
[ 83.451898][ T5941] __alloc_pages+0x1e3/0x460
[ 83.456472][ T5941] alloc_slab_page+0x5d/0x170
[ 83.461139][ T5941] new_slab+0x87/0x2e0
[ 83.465190][ T5941] ___slab_alloc+0xc6d/0x1300
[ 83.469852][ T5941] __kmem_cache_alloc_node+0x1a2/0x260
[ 83.475297][ T5941] __kmalloc+0xa4/0x240
[ 83.479435][ T5941] snd_pcm_hw_refine+0x97c/0x1620
[ 83.484443][ T5941] snd_pcm_oss_change_params_locked+0xa57/0x3d30
[ 83.490749][ T5941] snd_pcm_oss_write+0x2ff/0x1120
[ 83.495752][ T5941] vfs_write+0x288/0x940
[ 83.499973][ T5941] ksys_write+0x147/0x250
[ 83.504283][ T5941] do_syscall_64+0x55/0xb0
[ 83.508684][ T5941] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 83.514561][ T5941] page last free stack trace:
[ 83.519210][ T5941] free_unref_page_prepare+0x7ce/0x8e0
[ 83.524654][ T5941] free_unref_page+0x32/0x2e0
[ 83.529316][ T5941] __unfreeze_partials+0x1cf/0x210
[ 83.534411][ T5941] put_cpu_partial+0x17c/0x250
[ 83.539163][ T5941] __slab_free+0x31d/0x410
[ 83.543561][ T5941] qlist_free_all+0x75/0xe0
[ 83.548050][ T5941] kasan_quarantine_reduce+0x143/0x160
[ 83.553505][ T5941] __kasan_slab_alloc+0x22/0x80
[ 83.558355][ T5941] slab_post_alloc_hook+0x6e/0x4d0
[ 83.563454][ T5941] __kmem_cache_alloc_node+0x13e/0x260
[ 83.568905][ T5941] kmalloc_trace+0x2a/0xe0
[ 83.573305][ T5941] gro_cells_destroy+0x2f9/0x3d0
[ 83.578224][ T5941] ip_tunnel_dev_free+0x19/0x60
[ 83.583059][ T5941] netdev_run_todo+0xbcd/0xd90
[ 83.587817][ T5941] ip_tunnel_delete_nets+0x321/0x360
[ 83.593100][ T5941] cleanup_net+0x77f/0xb90
[ 83.597503][ T5941]
[ 83.599808][ T5941] Memory state around the buggy address:
[ 83.605418][ T5941] ffff88801cf65700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 83.613471][ T5941] ffff88801cf65780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.621522][ T5941] >ffff88801cf65800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[ 83.629562][ T5941] ^
[ 83.637516][ T5941] ffff88801cf65880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.645559][ T5941] ffff88801cf65900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[ 83.653597][ T5941] ==================================================================
[ 83.661650][ T5941] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 83.668835][ T5941] CPU: 0 PID: 5941 Comm: syz.0.17 Not tainted syzkaller #0
[ 83.676019][ T5941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 83.686066][ T5941] Call Trace:
[ 83.689329][ T5941]
[ 83.692244][ T5941] dump_stack_lvl+0x16c/0x230
[ 83.696917][ T5941] ? show_regs_print_info+0x20/0x20
[ 83.702106][ T5941] ? load_image+0x3b0/0x3b0
[ 83.706602][ T5941] panic+0x2c0/0x710
[ 83.710488][ T5941] ? __lock_acquire+0x7c80/0x7c80
[ 83.715504][ T5941] ? bpf_jit_dump+0xd0/0xd0
[ 83.719990][ T5941] ? _raw_spin_unlock_irqrestore+0xae/0x110
[ 83.725873][ T5941] ? _raw_spin_unlock+0x40/0x40
[ 83.730708][ T5941] ? copy_to_urb+0x255/0x440
[ 83.735291][ T5941] check_panic_on_warn+0x84/0xa0
[ 83.740218][ T5941] ? copy_to_urb+0x255/0x440
[ 83.744797][ T5941] end_report+0x6f/0x140
[ 83.749028][ T5941] kasan_report+0x128/0x150
[ 83.753518][ T5941] ? copy_to_urb+0x255/0x440
[ 83.758105][ T5941] kasan_check_range+0x288/0x290
[ 83.763029][ T5941] ? copy_to_urb+0x255/0x440
[ 83.767605][ T5941] __asan_memcpy+0x40/0x70
[ 83.772007][ T5941] copy_to_urb+0x255/0x440
[ 83.776412][ T5941] ? snd_usb_endpoint_next_packet_size+0x333/0x520
[ 83.782897][ T5941] prepare_playback_urb+0x932/0x1360
[ 83.788174][ T5941] ? start_endpoints+0x270/0x270
[ 83.793094][ T5941] ? __lock_acquire+0x7c80/0x7c80
[ 83.798101][ T5941] ? start_endpoints+0x270/0x270
[ 83.803025][ T5941] prepare_outbound_urb+0x372/0xc40
[ 83.808230][ T5941] ? verify_lock_unused+0x140/0x140
[ 83.813419][ T5941] ? __asan_memcpy+0x40/0x70
[ 83.818001][ T5941] ? snd_usb_queue_pending_output_urbs+0xd00/0xd00
[ 83.824490][ T5941] ? _copy_from_iter+0xe60/0x1290
[ 83.829503][ T5941] ? find_vmap_area+0xfc/0x110
[ 83.834257][ T5941] ? snd_usb_endpoint_start_quirk+0x1f7/0x310
[ 83.840316][ T5941] snd_usb_endpoint_start+0x4d9/0x1440
[ 83.845769][ T5941] ? snd_usb_endpoint_get_clock_rate+0x100/0x100
[ 83.852084][ T5941] ? do_raw_spin_lock+0x121/0x2c0
[ 83.857097][ T5941] start_endpoints+0xa1/0x270
[ 83.861759][ T5941] ? snd_usb_substream_playback_trigger+0x3ce/0x7a0
[ 83.868337][ T5941] snd_usb_substream_playback_trigger+0x3e0/0x7a0
[ 83.874742][ T5941] snd_pcm_do_start+0xb1/0x170
[ 83.879495][ T5941] snd_pcm_action+0xda/0x230
[ 83.884083][ T5941] __snd_pcm_lib_xfer+0x16fa/0x1c40
[ 83.889277][ T5941] ? __snd_pcm_lib_xfer+0x1c40/0x1c40
[ 83.894643][ T5941] ? fill_silence+0x240/0x240
[ 83.899308][ T5941] ? __mutex_unlock_slowpath+0x1a2/0x6a0
[ 83.904930][ T5941] ? resample_expand+0x7e4/0x860
[ 83.909865][ T5941] ? pcm_lib_apply_appl_ptr+0x510/0x510
[ 83.915409][ T5941] snd_pcm_oss_write3+0x1bc/0x320
[ 83.920422][ T5941] snd_pcm_plug_write_transfer+0x2b8/0x4a0
[ 83.926212][ T5941] ? __lock_acquire+0x7c80/0x7c80
[ 83.931223][ T5941] ? snd_pcm_plug_client_channels_buf+0x610/0x610
[ 83.937624][ T5941] ? snd_pcm_plug_client_channels_buf+0x46a/0x610
[ 83.944034][ T5941] snd_pcm_oss_write+0xbb5/0x1120
[ 83.949047][ T5941] ? snd_pcm_oss_read+0x8c0/0x8c0
[ 83.954059][ T5941] ? common_file_perm+0x198/0x1f0
[ 83.959069][ T5941] ? fsnotify_perm+0x5d/0x5e0
[ 83.963735][ T5941] ? security_file_permission+0x79/0xa0
[ 83.969269][ T5941] ? snd_pcm_oss_read+0x8c0/0x8c0
[ 83.974281][ T5941] vfs_write+0x288/0x940
[ 83.978511][ T5941] ? file_end_write+0x250/0x250
[ 83.983348][ T5941] ? __ia32_sys_get_robust_list+0x90/0x90
[ 83.989055][ T5941] ? __fdget_pos+0x1d8/0x330
[ 83.993628][ T5941] ksys_write+0x147/0x250
[ 83.997948][ T5941] ? __ia32_sys_read+0x90/0x90
[ 84.002700][ T5941] ? lockdep_hardirqs_on+0x98/0x150
[ 84.007889][ T5941] do_syscall_64+0x55/0xb0
[ 84.012294][ T5941] ? clear_bhb_loop+0x40/0x90
[ 84.016955][ T5941] ? clear_bhb_loop+0x40/0x90
[ 84.021619][ T5941] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 84.027494][ T5941] RIP: 0033:0x7f61c578f749
[ 84.031891][ T5941] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 84.051481][ T5941] RSP: 002b:00007fff33584288 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 84.059879][ T5941] RAX: ffffffffffffffda RBX: 00007f61c59e5fa0 RCX: 00007f61c578f749
[ 84.067834][ T5941] RDX: 00000000000005ce RSI: 0000200000000640 RDI: 0000000000000004
[ 84.075787][ T5941] RBP: 00007f61c5813f91 R08: 0000000000000000 R09: 0000000000000000
[ 84.083739][ T5941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 84.091690][ T5941] R13: 00007f61c59e5fa0 R14: 00007f61c59e5fa0 R15: 0000000000000003
[ 84.099652][ T5941]
[ 84.102763][ T5941] Kernel Offset: disabled
[ 84.107070][ T5941] Rebooting in 86400 seconds..