Warning: Permanently added '10.128.1.178' (ED25519) to the list of known hosts.
2026/10/04 10:30:06 parsed 1 programs
2026/10/04 10:30:06 serving rpc on tcp://40685
Setting up swapspace version 1, size = 127995904 bytes
[ 117.134316][ T5988] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 121.320924][ T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 121.320944][ T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 121.377511][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 121.377534][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 121.807664][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 121.818628][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 121.820150][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 121.834998][ T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 121.850132][ T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 123.260675][ T6074] bridge0: port 1(bridge_slave_0) entered blocking state
[ 123.260793][ T6074] bridge0: port 1(bridge_slave_0) entered disabled state
[ 123.260868][ T6074] bridge_slave_0: entered allmulticast mode
[ 123.261749][ T6074] bridge_slave_0: entered promiscuous mode
[ 123.265019][ T6074] bridge0: port 2(bridge_slave_1) entered blocking state
[ 123.265187][ T6074] bridge0: port 2(bridge_slave_1) entered disabled state
[ 123.265306][ T6074] bridge_slave_1: entered allmulticast mode
[ 123.266763][ T6074] bridge_slave_1: entered promiscuous mode
[ 123.295707][ T6074] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 123.299813][ T6074] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 123.347761][ T6074] team0: Port device team_slave_0 added
[ 123.350928][ T6074] team0: Port device team_slave_1 added
[ 123.374839][ T6074] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 123.374855][ T6074] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 123.374874][ T6074] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 123.376340][ T6074] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 123.376355][ T6074] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 123.376375][ T6074] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 123.435597][ T6074] hsr_slave_0: entered promiscuous mode
[ 123.437569][ T6074] hsr_slave_1: entered promiscuous mode
[ 124.050126][ T6074] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 124.055032][ T6074] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 124.055960][ T6074] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 124.059711][ T6074] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 124.060705][ T6074] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 124.077850][ T6074] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 124.081238][ T6074] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 124.089737][ T6074] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 124.137420][ T6074] bridge0: port 2(bridge_slave_1) entered blocking state
[ 124.137531][ T6074] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 124.137918][ T6074] bridge0: port 1(bridge_slave_0) entered blocking state
[ 124.138028][ T6074] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 124.207514][ T6074] 8021q: adding VLAN 0 to HW filter on device bond0
[ 124.231812][ T47] bridge0: port 1(bridge_slave_0) entered disabled state
[ 124.234335][ T47] bridge0: port 2(bridge_slave_1) entered disabled state
[ 124.262714][ T6074] 8021q: adding VLAN 0 to HW filter on device team0
[ 124.270262][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state
[ 124.270360][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 124.297967][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state
[ 124.298027][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 124.845513][ T6074] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 124.914383][ T6074] veth0_vlan: entered promiscuous mode
[ 124.930315][ T6074] veth1_vlan: entered promiscuous mode
[ 124.972812][ T6074] veth0_macvtap: entered promiscuous mode
[ 124.977923][ T6074] veth1_macvtap: entered promiscuous mode
[ 125.006643][ T6074] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 125.028112][ T6074] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 125.082733][ T47] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 125.082804][ T47] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 125.082844][ T47] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 125.082872][ T47] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 125.291843][ T44] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 125.430233][ T44] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 125.520628][ T44] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 126.313049][ T44] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/10/04 10:30:21 executed programs: 0
[ 126.828156][ T4931] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 126.835396][ T4931] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 126.835922][ T4931] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 126.836831][ T4931] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 126.837725][ T4931] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 127.552274][ T6202] bridge0: port 1(bridge_slave_0) entered blocking state
[ 127.552444][ T6202] bridge0: port 1(bridge_slave_0) entered disabled state
[ 127.552565][ T6202] bridge_slave_0: entered allmulticast mode
[ 127.554078][ T6202] bridge_slave_0: entered promiscuous mode
[ 127.557315][ T6202] bridge0: port 2(bridge_slave_1) entered blocking state
[ 127.557470][ T6202] bridge0: port 2(bridge_slave_1) entered disabled state
[ 127.557587][ T6202] bridge_slave_1: entered allmulticast mode
[ 127.561340][ T6202] bridge_slave_1: entered promiscuous mode
[ 127.606954][ T6202] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 127.613804][ T6202] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 127.679029][ T6202] team0: Port device team_slave_0 added
[ 127.707628][ T6202] team0: Port device team_slave_1 added
[ 127.769496][ T6202] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 127.769512][ T6202] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 127.769532][ T6202] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 127.772057][ T6202] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 127.772073][ T6202] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 127.772093][ T6202] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 127.880004][ T44] bridge_slave_1: left allmulticast mode
[ 127.880028][ T44] bridge_slave_1: left promiscuous mode
[ 127.883063][ T44] bridge0: port 2(bridge_slave_1) entered disabled state
[ 127.902414][ T44] bridge_slave_0: left allmulticast mode
[ 127.902442][ T44] bridge_slave_0: left promiscuous mode
[ 127.902760][ T44] bridge0: port 1(bridge_slave_0) entered disabled state
[ 128.124154][ T44] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 128.127042][ T44] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 128.131818][ T44] bond0 (unregistering): Released all slaves
[ 128.276659][ T44] hsr_slave_0: left promiscuous mode
[ 128.277505][ T44] hsr_slave_1: left promiscuous mode
[ 128.279633][ T44] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 128.279654][ T44] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 128.306260][ T44] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 128.306282][ T44] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 128.320888][ T44] veth1_macvtap: left promiscuous mode
[ 128.320929][ T44] veth0_macvtap: left promiscuous mode
[ 128.323505][ T44] veth1_vlan: left promiscuous mode
[ 128.323575][ T44] veth0_vlan: left promiscuous mode
[ 128.731875][ T44] team0 (unregistering): Port device team_slave_1 removed
[ 128.768757][ T44] team0 (unregistering): Port device team_slave_0 removed
[ 128.878491][ T55] Bluetooth: hci0: command tx timeout
[ 128.973298][ T6202] hsr_slave_0: entered promiscuous mode
[ 128.997758][ T6202] hsr_slave_1: entered promiscuous mode
[ 129.884333][ T6202] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 129.900629][ T6202] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 129.903137][ T6202] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 129.906444][ T6202] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 129.933677][ T6202] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 129.937481][ T6202] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 129.953605][ T6202] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 129.956972][ T6202] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 130.061253][ T6202] 8021q: adding VLAN 0 to HW filter on device bond0
[ 130.084584][ T6202] 8021q: adding VLAN 0 to HW filter on device team0
[ 130.099881][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 130.099981][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 130.106896][ T47] bridge0: port 2(bridge_slave_1) entered blocking state
[ 130.106991][ T47] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 130.634380][ T6202] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 130.707001][ T6202] veth0_vlan: entered promiscuous mode
[ 130.729716][ T6202] veth1_vlan: entered promiscuous mode
[ 130.762577][ T6202] veth0_macvtap: entered promiscuous mode
[ 130.776401][ T6202] veth1_macvtap: entered promiscuous mode
[ 130.795030][ T6202] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 130.807783][ T6202] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 130.871807][ T3326] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.871850][ T3326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.871877][ T3326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.871900][ T3326] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.940782][ T3326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 130.940803][ T3326] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 130.958544][ T55] Bluetooth: hci0: command tx timeout
[ 130.987815][ T3326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 130.987835][ T3326] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 131.111153][ T6329] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000
[ 131.111833][ T6329] udc dummy_udc.0: failed to start g1: -19
[ 131.116641][ T6329] UDC core: g1: couldn't find an available UDC or it's busy
[ 131.169544][ T6331] ==================================================================
[ 131.169559][ T6331] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190
[ 131.169596][ T6331] Read of size 8 at addr ffff88807e139658 by task syz.0.18/6331
[ 131.169609][ T6331]
[ 131.169629][ T6331] CPU: 0 UID: 0 PID: 6331 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
[ 131.169652][ T6331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 131.169669][ T6331] Call Trace:
[ 131.169679][ T6331]
[ 131.169687][ T6331] dump_stack_lvl+0xe8/0x150
[ 131.169710][ T6331] print_address_description+0x55/0x1e0
[ 131.169729][ T6331] ? filp_flush+0x31/0x190
[ 131.169743][ T6331] print_report+0x58/0x70
[ 131.169758][ T6331] kasan_report+0x117/0x150
[ 131.169775][ T6331] ? filp_flush+0x31/0x190
[ 131.169793][ T6331] kasan_check_range+0x264/0x2c0
[ 131.169809][ T6331] filp_flush+0x31/0x190
[ 131.169825][ T6331] filp_close+0x1d/0x40
[ 131.169840][ T6331] gaudio_cleanup+0x54/0xf0
[ 131.169860][ T6331] f_audio_bind+0x4a0/0x630
[ 131.169877][ T6331] ? __pfx_f_audio_bind+0x10/0x10
[ 131.169891][ T6331] ? __kmalloc_cache_noprof+0x31c/0x600
[ 131.169908][ T6331] ? rcu_is_watching+0x16/0xb0
[ 131.169925][ T6331] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 131.169943][ T6331] usb_add_function+0x2e1/0x9f0
[ 131.169959][ T6331] ? check_remote_wakeup_config+0x58/0x1c0
[ 131.169977][ T6331] configfs_composite_bind+0xde0/0x1410
[ 131.169998][ T6331] ? __pfx_configfs_composite_bind+0x10/0x10
[ 131.170013][ T6331] gadget_bind_driver+0x2ca/0x9e0
[ 131.170154][ T6331] ? __pfx_gadget_bind_driver+0x10/0x10
[ 131.170168][ T6331] really_probe+0x254/0xae0
[ 131.170184][ T6331] __driver_probe_device+0x1e8/0x360
[ 131.170199][ T6331] driver_probe_device+0x4f/0x240
[ 131.170214][ T6331] __driver_attach+0x339/0x600
[ 131.170228][ T6331] bus_for_each_dev+0x23b/0x2c0
[ 131.170242][ T6331] ? __pfx___driver_attach+0x10/0x10
[ 131.170255][ T6331] ? __pfx_bus_for_each_dev+0x10/0x10
[ 131.170272][ T6331] ? do_raw_spin_unlock+0xf5/0x200
[ 131.170290][ T6331] bus_add_driver+0x38f/0x6e0
[ 131.170309][ T6331] driver_register+0x23a/0x320
[ 131.170323][ T6331] usb_gadget_register_driver_owner+0xf9/0x270
[ 131.170342][ T6331] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 131.170359][ T6331] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 131.170376][ T6331] configfs_write_iter+0x337/0x430
[ 131.170393][ T6331] vfs_write+0x612/0xba0
[ 131.170412][ T6331] ? __pfx_vfs_write+0x10/0x10
[ 131.170427][ T6331] ? __fget_files+0x3a2/0x420
[ 131.170441][ T6331] ? __fget_files+0x2a/0x420
[ 131.170458][ T6331] ? fdget+0x1ac/0x250
[ 131.170475][ T6331] ksys_write+0x150/0x270
[ 131.170491][ T6331] ? __pfx_ksys_write+0x10/0x10
[ 131.170510][ T6331] do_syscall_64+0x166/0x520
[ 131.170526][ T6331] ? trace_irq_disable+0x3b/0x140
[ 131.170541][ T6331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.170558][ T6331] ? clear_bhb_loop+0x70/0xc0
[ 131.170575][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.170590][ T6331] RIP: 0033:0x7f742b59df99
[ 131.170619][ T6331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 131.170643][ T6331] RSP: 002b:00007f742c45d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 131.170666][ T6331] RAX: ffffffffffffffda RBX: 00007f742b825fa0 RCX: 00007f742b59df99
[ 131.170679][ T6331] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 131.170690][ T6331] RBP: 00007f742b634ec4 R08: 0000000000000000 R09: 0000000000000000
[ 131.170700][ T6331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 131.170710][ T6331] R13: 00007f742b826038 R14: 00007f742b825fa0 R15: 00007ffc1e93c728
[ 131.170730][ T6331]
[ 131.170735][ T6331]
[ 131.170738][ T6331] Allocated by task 6329:
[ 131.170745][ T6331] kasan_save_track+0x3e/0x80
[ 131.170760][ T6331] __kasan_slab_alloc+0x6c/0x80
[ 131.170774][ T6331] kmem_cache_alloc_noprof+0x2b4/0x600
[ 131.170788][ T6331] alloc_empty_file+0x5b/0x1d0
[ 131.170799][ T6331] path_openat+0x9d/0x1da0
[ 131.170811][ T6331] do_file_open+0x23e/0x4a0
[ 131.170823][ T6331] filp_open+0x16d/0x1d0
[ 131.170835][ T6331] gaudio_setup+0x11b/0xf10
[ 131.170849][ T6331] f_audio_bind+0x137/0x630
[ 131.170862][ T6331] usb_add_function+0x2e1/0x9f0
[ 131.170881][ T6331] configfs_composite_bind+0xde0/0x1410
[ 131.170895][ T6331] gadget_bind_driver+0x2ca/0x9e0
[ 131.170909][ T6331] really_probe+0x254/0xae0
[ 131.170921][ T6331] __driver_probe_device+0x1e8/0x360
[ 131.170933][ T6331] driver_probe_device+0x4f/0x240
[ 131.170945][ T6331] __driver_attach+0x339/0x600
[ 131.170958][ T6331] bus_for_each_dev+0x23b/0x2c0
[ 131.170970][ T6331] bus_add_driver+0x38f/0x6e0
[ 131.170983][ T6331] driver_register+0x23a/0x320
[ 131.170996][ T6331] usb_gadget_register_driver_owner+0xf9/0x270
[ 131.171012][ T6331] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 131.171035][ T6331] configfs_write_iter+0x337/0x430
[ 131.171048][ T6331] vfs_write+0x612/0xba0
[ 131.171061][ T6331] ksys_write+0x150/0x270
[ 131.171073][ T6331] do_syscall_64+0x166/0x520
[ 131.171086][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.171102][ T6331]
[ 131.171106][ T6331] Freed by task 5280:
[ 131.171114][ T6331] kasan_save_track+0x3e/0x80
[ 131.171127][ T6331] kasan_save_free_info+0x40/0x50
[ 131.171141][ T6331] __kasan_slab_free+0x5c/0x80
[ 131.171154][ T6331] slab_free_after_rcu_debug+0x12a/0x220
[ 131.171169][ T6331] rcu_core+0x926/0x1260
[ 131.171183][ T6331] handle_softirqs+0x223/0x840
[ 131.171197][ T6331] __irq_exit_rcu+0xcb/0x220
[ 131.171210][ T6331] irq_exit_rcu+0x9/0x30
[ 131.171223][ T6331] sysvec_apic_timer_interrupt+0x57/0xc0
[ 131.171237][ T6331] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 131.171252][ T6331]
[ 131.171256][ T6331] Last potentially related work creation:
[ 131.171262][ T6331] kasan_save_stack+0x3e/0x60
[ 131.171276][ T6331] kasan_record_aux_stack+0xbd/0xd0
[ 131.171289][ T6331] kmem_cache_free+0x45e/0x650
[ 131.171303][ T6331] task_work_run+0x1d9/0x260
[ 131.171316][ T6331] exit_to_user_mode_loop+0x204/0x770
[ 131.171328][ T6331] do_syscall_64+0x328/0x520
[ 131.171341][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.171356][ T6331]
[ 131.171360][ T6331] Second to last potentially related work creation:
[ 131.171366][ T6331] kasan_save_stack+0x3e/0x60
[ 131.171379][ T6331] kasan_record_aux_stack+0xbd/0xd0
[ 131.171393][ T6331] task_work_add+0xae/0x420
[ 131.171406][ T6331] __fput_deferred+0x152/0x390
[ 131.171420][ T6331] fput_close+0x11f/0x240
[ 131.171432][ T6331] filp_close+0x27/0x40
[ 131.171445][ T6331] gaudio_cleanup+0x54/0xf0
[ 131.171458][ T6331] f_audio_bind+0x4a0/0x630
[ 131.171471][ T6331] usb_add_function+0x2e1/0x9f0
[ 131.171485][ T6331] configfs_composite_bind+0xde0/0x1410
[ 131.171499][ T6331] gadget_bind_driver+0x2ca/0x9e0
[ 131.171513][ T6331] really_probe+0x254/0xae0
[ 131.171526][ T6331] __driver_probe_device+0x1e8/0x360
[ 131.171537][ T6331] driver_probe_device+0x4f/0x240
[ 131.171547][ T6331] __driver_attach+0x339/0x600
[ 131.171556][ T6331] bus_for_each_dev+0x23b/0x2c0
[ 131.171567][ T6331] bus_add_driver+0x38f/0x6e0
[ 131.171576][ T6331] driver_register+0x23a/0x320
[ 131.171586][ T6331] usb_gadget_register_driver_owner+0xf9/0x270
[ 131.171601][ T6331] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 131.171615][ T6331] configfs_write_iter+0x337/0x430
[ 131.171628][ T6331] vfs_write+0x612/0xba0
[ 131.171641][ T6331] ksys_write+0x150/0x270
[ 131.171653][ T6331] do_syscall_64+0x166/0x520
[ 131.171667][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.171683][ T6331]
[ 131.171687][ T6331] The buggy address belongs to the object at ffff88807e139500
[ 131.171687][ T6331] which belongs to the cache filp of size 352
[ 131.171700][ T6331] The buggy address is located 344 bytes inside of
[ 131.171700][ T6331] freed 352-byte region [ffff88807e139500, ffff88807e139660)
[ 131.171716][ T6331]
[ 131.171720][ T6331] The buggy address belongs to the physical page:
[ 131.171737][ T6331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e138
[ 131.171752][ T6331] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 131.171764][ T6331] memcg:ffff888022eff201
[ 131.171772][ T6331] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 131.171795][ T6331] page_type: f5(slab)
[ 131.171810][ T6331] raw: 00fff00000000040 ffff88801c6be640 dead000000000100 dead000000000122
[ 131.171824][ T6331] raw: 0000000000000000 0000000200120012 00000000f5000000 ffff888022eff201
[ 131.171838][ T6331] head: 00fff00000000040 ffff88801c6be640 dead000000000100 dead000000000122
[ 131.171852][ T6331] head: 0000000000000000 0000000200120012 00000000f5000000 ffff888022eff201
[ 131.171867][ T6331] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 131.171881][ T6331] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 131.171889][ T6331] page dumped because: kasan: bad access detected
[ 131.171902][ T6331] page_owner tracks the page as allocated
[ 131.171907][ T6331] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4989, tgid 4989 (udevd), ts 32332637928
[ 131.171933][ T6331] post_alloc_hook+0x1f9/0x250
[ 131.171948][ T6331] get_page_from_freelist+0x220f/0x2280
[ 131.171962][ T6331] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 131.171975][ T6331] allocate_slab+0x7d/0x5e0
[ 131.171988][ T6331] refill_objects+0x2d5/0x350
[ 131.172001][ T6331] __pcs_replace_empty_main+0x2c8/0x6c0
[ 131.172015][ T6331] kmem_cache_alloc_noprof+0x394/0x600
[ 131.172040][ T6331] alloc_empty_file+0x5b/0x1d0
[ 131.172053][ T6331] path_openat+0x9d/0x1da0
[ 131.172066][ T6331] do_file_open+0x23e/0x4a0
[ 131.172078][ T6331] do_sys_openat2+0x115/0x200
[ 131.172091][ T6331] __x64_sys_openat+0x138/0x170
[ 131.172104][ T6331] do_syscall_64+0x166/0x520
[ 131.172117][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.172131][ T6331] page last free pid 4987 tgid 4987 ts 32316522505 stack trace:
[ 131.172143][ T6331] __free_frozen_pages+0xc97/0xd90
[ 131.172157][ T6331] __slab_free+0x269/0x2c0
[ 131.172170][ T6331] qlist_free_all+0x99/0x100
[ 131.172183][ T6331] kasan_quarantine_reduce+0x148/0x160
[ 131.172199][ T6331] __kasan_slab_alloc+0x22/0x80
[ 131.172211][ T6331] kmem_cache_alloc_noprof+0x2b4/0x600
[ 131.172224][ T6331] alloc_empty_file+0x5b/0x1d0
[ 131.172237][ T6331] path_openat+0x9d/0x1da0
[ 131.172247][ T6331] do_file_open+0x23e/0x4a0
[ 131.172259][ T6331] do_sys_openat2+0x115/0x200
[ 131.172272][ T6331] __x64_sys_openat+0x138/0x170
[ 131.172283][ T6331] do_syscall_64+0x166/0x520
[ 131.172296][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.172311][ T6331]
[ 131.172315][ T6331] Memory state around the buggy address:
[ 131.172324][ T6331] ffff88807e139500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 131.172334][ T6331] ffff88807e139580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 131.172345][ T6331] >ffff88807e139600: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 131.172353][ T6331] ^
[ 131.172363][ T6331] ffff88807e139680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 131.172373][ T6331] ffff88807e139700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 131.172381][ T6331] ==================================================================
[ 131.172439][ T6331] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 132.308079][ T6331] CPU: 0 UID: 0 PID: 6331 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
[ 132.317629][ T6331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 132.328382][ T6331] Call Trace:
[ 132.331938][ T6331]
[ 132.335221][ T6331] vpanic+0x26f/0x710
[ 132.339354][ T6331] panic+0xc5/0xd0
[ 132.343258][ T6331] ? __pfx_panic+0x10/0x10
[ 132.348206][ T6331] ? preempt_schedule_thunk+0x16/0x40
[ 132.353855][ T6331] ? filp_flush+0x31/0x190
[ 132.358538][ T6331] ? preempt_schedule_thunk+0x16/0x40
[ 132.364178][ T6331] ? filp_flush+0x31/0x190
[ 132.368680][ T6331] check_panic_on_warn+0x89/0xb0
[ 132.373700][ T6331] ? filp_flush+0x31/0x190
[ 132.378220][ T6331] end_report+0x73/0x170
[ 132.382564][ T6331] ? filp_flush+0x31/0x190
[ 132.387422][ T6331] kasan_report+0x128/0x150
[ 132.392033][ T6331] ? filp_flush+0x31/0x190
[ 132.396459][ T6331] kasan_check_range+0x264/0x2c0
[ 132.401558][ T6331] filp_flush+0x31/0x190
[ 132.406080][ T6331] filp_close+0x1d/0x40
[ 132.410500][ T6331] gaudio_cleanup+0x54/0xf0
[ 132.415184][ T6331] f_audio_bind+0x4a0/0x630
[ 132.419766][ T6331] ? __pfx_f_audio_bind+0x10/0x10
[ 132.424943][ T6331] ? __kmalloc_cache_noprof+0x31c/0x600
[ 132.430962][ T6331] ? rcu_is_watching+0x16/0xb0
[ 132.435834][ T6331] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 132.441798][ T6331] usb_add_function+0x2e1/0x9f0
[ 132.446646][ T6331] ? check_remote_wakeup_config+0x58/0x1c0
[ 132.452549][ T6331] configfs_composite_bind+0xde0/0x1410
[ 132.458379][ T6331] ? __pfx_configfs_composite_bind+0x10/0x10
[ 132.464391][ T6331] gadget_bind_driver+0x2ca/0x9e0
[ 132.469765][ T6331] ? __pfx_gadget_bind_driver+0x10/0x10
[ 132.475518][ T6331] really_probe+0x254/0xae0
[ 132.480208][ T6331] __driver_probe_device+0x1e8/0x360
[ 132.485497][ T6331] driver_probe_device+0x4f/0x240
[ 132.490518][ T6331] __driver_attach+0x339/0x600
[ 132.495371][ T6331] bus_for_each_dev+0x23b/0x2c0
[ 132.500327][ T6331] ? __pfx___driver_attach+0x10/0x10
[ 132.505713][ T6331] ? __pfx_bus_for_each_dev+0x10/0x10
[ 132.511163][ T6331] ? do_raw_spin_unlock+0xf5/0x200
[ 132.516449][ T6331] bus_add_driver+0x38f/0x6e0
[ 132.521231][ T6331] driver_register+0x23a/0x320
[ 132.526011][ T6331] usb_gadget_register_driver_owner+0xf9/0x270
[ 132.532181][ T6331] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 132.537824][ T6331] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 132.543979][ T6331] configfs_write_iter+0x337/0x430
[ 132.549295][ T6331] vfs_write+0x612/0xba0
[ 132.553536][ T6331] ? __pfx_vfs_write+0x10/0x10
[ 132.558471][ T6331] ? __fget_files+0x3a2/0x420
[ 132.563138][ T6331] ? __fget_files+0x2a/0x420
[ 132.567985][ T6331] ? fdget+0x1ac/0x250
[ 132.572055][ T6331] ksys_write+0x150/0x270
[ 132.576475][ T6331] ? __pfx_ksys_write+0x10/0x10
[ 132.581337][ T6331] do_syscall_64+0x166/0x520
[ 132.585932][ T6331] ? trace_irq_disable+0x3b/0x140
[ 132.590968][ T6331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.597110][ T6331] ? clear_bhb_loop+0x70/0xc0
[ 132.601864][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.607884][ T6331] RIP: 0033:0x7f742b59df99
[ 132.612367][ T6331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 132.632767][ T6331] RSP: 002b:00007f742c45d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 132.641441][ T6331] RAX: ffffffffffffffda RBX: 00007f742b825fa0 RCX: 00007f742b59df99
[ 132.649682][ T6331] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 132.657665][ T6331] RBP: 00007f742b634ec4 R08: 0000000000000000 R09: 0000000000000000
[ 132.665773][ T6331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 132.673926][ T6331] R13: 00007f742b826038 R14: 00007f742b825fa0 R15: 00007ffc1e93c728
[ 132.681899][ T6331]
[ 132.685277][ T6331] Kernel Offset: disabled
[ 132.689616][ T6331] Rebooting in 86400 seconds..