Warning: Permanently added '10.128.1.175' (ED25519) to the list of known hosts.
[*] Starting Phase 2 reproducer for KASAN slab-use-after-free in seq_printf...
[+] open /proc/interrupts successful.
[+] lseek /proc/interrupts successful.
[+] close /proc/interrupts successful.
[*] readlink ttyS0/device: '../../../00:02:0.0'
[*] readlink ttyS1/device: '../../../00:03:0.0'
[+] Identified console PNP device: 00:02
[+] Identified target PNP device: 00:03
[+] unbind sysfs file is accessible.
[+] bind sysfs file is accessible.
[+] 00:03 is already bound to serial driver.
[+] Created 2 slab churn threads.
[+] Created 2 proc reader threads.
[*] Starting serial port sharing and unbind/rebind race loop...
[ 122.124216][ T5994] ==================================================================
[ 122.124260][ T5994] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 122.124304][ T5994] Read of size 1 at addr ffff8880280552a0 by task syz-executor119/5994
[ 122.124320][ T5994]
[ 122.124345][ T5994] CPU: 1 UID: 0 PID: 5994 Comm: syz-executor119 Tainted: G Y syzkaller #0 PREEMPT(full)
[ 122.124374][ T5994] Tainted: [Y]=FORCED_BIND
[ 122.124381][ T5994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 122.124402][ T5994] Call Trace:
[ 122.124410][ T5994]
[ 122.124423][ T5994] dump_stack_lvl+0xe8/0x150
[ 122.124456][ T5994] print_address_description+0x55/0x1e0
[ 122.124481][ T5994] ? string+0x216/0x2d0
[ 122.124503][ T5994] print_report+0x58/0x70
[ 122.124526][ T5994] kasan_report+0x117/0x150
[ 122.124553][ T5994] ? string+0x216/0x2d0
[ 122.124580][ T5994] string+0x216/0x2d0
[ 122.124609][ T5994] vsnprintf+0x74a/0xef0
[ 122.124642][ T5994] seq_printf+0x188/0x290
[ 122.124663][ T5994] ? __pfx_seq_printf+0x10/0x10
[ 122.124680][ T5994] ? seq_put_decimal_ull_width+0x290/0x370
[ 122.124706][ T5994] irq_seq_show+0x5fc/0x820
[ 122.124741][ T5994] traverse+0x229/0x620
[ 122.124788][ T5994] seq_lseek+0x134/0x260
[ 122.124822][ T5994] proc_reg_llseek+0x1bc/0x290
[ 122.124846][ T5994] __x64_sys_lseek+0x14f/0x1e0
[ 122.124873][ T5994] do_syscall_64+0x166/0x520
[ 122.124896][ T5994] ? trace_irq_disable+0x3b/0x140
[ 122.124925][ T5994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.124947][ T5994] ? clear_bhb_loop+0x70/0xc0
[ 122.124970][ T5994] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.124991][ T5994] RIP: 0033:0x7f2161683707
[ 122.125016][ T5994] Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 b8 08 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 48
[ 122.125034][ T5994] RSP: 002b:00007f215fe441e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000008
[ 122.125061][ T5994] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007f2161683707
[ 122.125076][ T5994] RDX: 0000000000000000 RSI: 0000000200000008 RDI: 0000000000000007
[ 122.125089][ T5994] RBP: 00007f21616ea034 R08: 0000000000000000 R09: 0000000000000000
[ 122.125101][ T5994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000200000008
[ 122.125113][ T5994] R13: 00007f215fe441f0 R14: 00007fff37c40200 R15: 00007fff37c402e8
[ 122.125138][ T5994]
[ 122.125144][ T5994]
[ 122.125149][ T5994] Allocated by task 1:
[ 122.125158][ T5994] kasan_save_track+0x3e/0x80
[ 122.125183][ T5994] __kasan_kmalloc+0x93/0xb0
[ 122.125208][ T5994] __kmalloc_node_track_caller_noprof+0x4af/0x720
[ 122.125232][ T5994] kvasprintf+0xeb/0x1a0
[ 122.125255][ T5994] kasprintf+0xe2/0x140
[ 122.125277][ T5994] serial_core_register_port+0x611/0x2b80
[ 122.125301][ T5994] serial8250_register_8250_port+0x1a2c/0x2400
[ 122.125323][ T5994] serial_pnp_probe+0x576/0x7d0
[ 122.125344][ T5994] pnp_device_probe+0x313/0x4d0
[ 122.125364][ T5994] really_probe+0x254/0xae0
[ 122.125386][ T5994] __driver_probe_device+0x1e8/0x360
[ 122.125403][ T5994] driver_probe_device+0x4f/0x240
[ 122.125420][ T5994] __driver_attach+0x34e/0x630
[ 122.125437][ T5994] bus_for_each_dev+0x23b/0x2c0
[ 122.125459][ T5994] bus_add_driver+0x38f/0x6e0
[ 122.125481][ T5994] driver_register+0x23a/0x320
[ 122.125503][ T5994] serial8250_init+0x8f/0x160
[ 122.125521][ T5994] do_one_initcall+0x250/0x870
[ 122.125538][ T5994] do_initcall_level+0x10a/0x1a0
[ 122.125559][ T5994] do_initcalls+0x59/0xa0
[ 122.125579][ T5994] kernel_init_freeable+0x29d/0x3e0
[ 122.125598][ T5994] kernel_init+0x22/0x1d0
[ 122.125620][ T5994] ret_from_fork+0x514/0xb70
[ 122.125639][ T5994] ret_from_fork_asm+0x1a/0x30
[ 122.125656][ T5994]
[ 122.125661][ T5994] Freed by task 5990:
[ 122.125671][ T5994] kasan_save_track+0x3e/0x80
[ 122.125693][ T5994] kasan_save_free_info+0x40/0x50
[ 122.125712][ T5994] __kasan_slab_free+0x5c/0x80
[ 122.125737][ T5994] kfree+0x1c5/0x650
[ 122.125754][ T5994] serial_core_unregister_port+0x500/0xb80
[ 122.125786][ T5994] serial8250_unregister_port+0x250/0x770
[ 122.125807][ T5994] pnp_device_remove+0x82/0x260
[ 122.125826][ T5994] device_release_driver_internal+0x42b/0x7d0
[ 122.125848][ T5994] unbind_store+0x1cb/0x200
[ 122.125877][ T5994] kernfs_fop_write_iter+0x3a4/0x540
[ 122.125899][ T5994] vfs_write+0x612/0xba0
[ 122.125930][ T5994] ksys_write+0x150/0x270
[ 122.125952][ T5994] do_syscall_64+0x166/0x520
[ 122.125973][ T5994] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.125992][ T5994]
[ 122.125998][ T5994] The buggy address belongs to the object at ffff8880280552a0
[ 122.125998][ T5994] which belongs to the cache kmalloc-8 of size 8
[ 122.126014][ T5994] The buggy address is located 0 bytes inside of
[ 122.126014][ T5994] freed 8-byte region [ffff8880280552a0, ffff8880280552a8)
[ 122.126035][ T5994]
[ 122.126040][ T5994] The buggy address belongs to the physical page:
[ 122.126059][ T5994] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880280553a0 pfn:0x28055
[ 122.126079][ T5994] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 122.126103][ T5994] page_type: f5(slab)
[ 122.126122][ T5994] raw: 00fff00000000200 ffff88813ff22500 ffffea0000a14610 ffffea000083dc50
[ 122.126140][ T5994] raw: ffff8880280553a0 000000000080007a 00000000f5000000 0000000000000000
[ 122.126151][ T5994] page dumped because: kasan: bad access detected
[ 122.126166][ T5994] page_owner tracks the page as allocated
[ 122.126177][ T5994] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6950794147
[ 122.126208][ T5994] post_alloc_hook+0x1f9/0x250
[ 122.126228][ T5994] get_page_from_freelist+0x220f/0x2280
[ 122.126253][ T5994] __alloc_frozen_pages_noprof+0x1fe/0x410
[ 122.126277][ T5994] allocate_slab+0x7d/0x5e0
[ 122.126306][ T5994] refill_objects+0x2d5/0x350
[ 122.126322][ T5994] __pcs_replace_empty_main+0x2c8/0x6c0
[ 122.126351][ T5994] __kmalloc_node_track_caller_noprof+0x543/0x720
[ 122.126376][ T5994] kstrdup+0x42/0x100
[ 122.126394][ T5994] __kernfs_new_node+0xa9/0x980
[ 122.126412][ T5994] kernfs_new_node+0xeb/0x140
[ 122.126428][ T5994] kernfs_create_link+0xe3/0x240
[ 122.126451][ T5994] sysfs_do_create_link_sd+0x83/0x110
[ 122.126480][ T5994] driver_sysfs_add+0x89/0x210
[ 122.126499][ T5994] really_probe+0x142/0xae0
[ 122.126518][ T5994] __driver_probe_device+0x1e8/0x360
[ 122.126537][ T5994] driver_probe_device+0x4f/0x240
[ 122.126556][ T5994] page last free pid 12 tgid 12 ts 6949306649 stack trace:
[ 122.126568][ T5994] __free_frozen_pages+0xc97/0xd90
[ 122.126586][ T5994] __kasan_populate_vmalloc+0x1a8/0x1c0
[ 122.126606][ T5994] alloc_vmap_area+0xd10/0x1410
[ 122.126620][ T5994] __get_vm_area_node+0x200/0x2f0
[ 122.126635][ T5994] __vmalloc_node_range_noprof+0x36e/0x16f0
[ 122.126655][ T5994] __vmalloc_node_noprof+0xc2/0x100
[ 122.126673][ T5994] dup_task_struct+0x2c6/0xa00
[ 122.126697][ T5994] copy_process+0x7ea/0x44b0
[ 122.126717][ T5994] kernel_clone+0x2d7/0x940
[ 122.126740][ T5994] user_mode_thread+0x115/0x180
[ 122.126765][ T5994] call_usermodehelper_exec_work+0x5c/0x230
[ 122.126800][ T5994] process_scheduled_works+0xc3d/0x1630
[ 122.126826][ T5994] worker_thread+0xa47/0xfb0
[ 122.126851][ T5994] kthread+0x38b/0x480
[ 122.126871][ T5994] ret_from_fork+0x514/0xb70
[ 122.126889][ T5994] ret_from_fork_asm+0x1a/0x30
[ 122.126909][ T5994]
[ 122.126912][ T5994] Memory state around the buggy address:
[ 122.126922][ T5994] ffff888028055180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[ 122.126934][ T5994] ffff888028055200: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[ 122.126946][ T5994] >ffff888028055280: fa fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc
[ 122.126955][ T5994] ^
[ 122.126965][ T5994] ffff888028055300: fa fc fc fc fa fc fc fc fa fc fc fc 06 fc fc fc
[ 122.126978][ T5994] ffff888028055380: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[ 122.126988][ T5994] ==================================================================
[ 122.127011][ T5994] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 122.910960][ T5994] CPU: 1 UID: 0 PID: 5994 Comm: syz-executor119 Tainted: G Y syzkaller #0 PREEMPT(full)
[ 122.922711][ T5994] Tainted: [Y]=FORCED_BIND
[ 122.927212][ T5994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 122.937293][ T5994] Call Trace:
[ 122.940805][ T5994]
[ 122.943832][ T5994] vpanic+0x26f/0x710
[ 122.947873][ T5994] panic+0xc5/0xd0
[ 122.951640][ T5994] ? __pfx_panic+0x10/0x10
[ 122.956098][ T5994] ? string+0x216/0x2d0
[ 122.960309][ T5994] ? rcu_is_watching+0x16/0xb0
[ 122.965127][ T5994] ? string+0x216/0x2d0
[ 122.969352][ T5994] ? string+0x216/0x2d0
[ 122.973549][ T5994] check_panic_on_warn+0x89/0xb0
[ 122.978529][ T5994] ? string+0x216/0x2d0
[ 122.982783][ T5994] end_report+0x73/0x170
[ 122.987168][ T5994] ? string+0x216/0x2d0
[ 122.991360][ T5994] kasan_report+0x128/0x150
[ 122.995901][ T5994] ? string+0x216/0x2d0
[ 123.000186][ T5994] string+0x216/0x2d0
[ 123.004209][ T5994] vsnprintf+0x74a/0xef0
[ 123.008586][ T5994] seq_printf+0x188/0x290
[ 123.012950][ T5994] ? __pfx_seq_printf+0x10/0x10
[ 123.017928][ T5994] ? seq_put_decimal_ull_width+0x290/0x370
[ 123.023788][ T5994] irq_seq_show+0x5fc/0x820
[ 123.028345][ T5994] traverse+0x229/0x620
[ 123.032755][ T5994] seq_lseek+0x134/0x260
[ 123.037069][ T5994] proc_reg_llseek+0x1bc/0x290
[ 123.041886][ T5994] __x64_sys_lseek+0x14f/0x1e0
[ 123.046701][ T5994] do_syscall_64+0x166/0x520
[ 123.051329][ T5994] ? trace_irq_disable+0x3b/0x140
[ 123.056390][ T5994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.062737][ T5994] ? clear_bhb_loop+0x70/0xc0
[ 123.067648][ T5994] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.073856][ T5994] RIP: 0033:0x7f2161683707
[ 123.078321][ T5994] Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 b8 08 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 48
[ 123.098307][ T5994] RSP: 002b:00007f215fe441e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000008
[ 123.107054][ T5994] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007f2161683707
[ 123.115336][ T5994] RDX: 0000000000000000 RSI: 0000000200000008 RDI: 0000000000000007
[ 123.123641][ T5994] RBP: 00007f21616ea034 R08: 0000000000000000 R09: 0000000000000000
[ 123.131816][ T5994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000200000008
[ 123.139818][ T5994] R13: 00007f215fe441f0 R14: 00007fff37c40200 R15: 00007fff37c402e8
[ 123.147840][ T5994]
[ 123.151500][ T5994] Kernel Offset: disabled
[ 123.155850][ T5994] Rebooting in 86400 seconds..