Warning: Permanently added '[localhost]:34478' (ED25519) to the list of known hosts.
2024/01/22 20:50:54 ignoring optional flag "sandboxArg"="0"
[ 92.934613][ T33] cfg80211: failed to load regulatory.db
2024/01/22 20:50:54 parsed 1 programs
[ 93.322665][ T38] kauditd_printk_skb: 73 callbacks suppressed
[ 93.322680][ T38] audit: type=1400 audit(1705956654.622:204): avc: denied { getattr } for pid=5399 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 93.336649][ T38] audit: type=1400 audit(1705956654.622:205): avc: denied { read } for pid=5399 comm="syz-execprog" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 93.348121][ T38] audit: type=1400 audit(1705956654.622:206): avc: denied { open } for pid=5399 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 93.360572][ T38] audit: type=1400 audit(1705956654.632:207): avc: denied { read } for pid=5399 comm="syz-execprog" name="raw-gadget" dev="devtmpfs" ino=760 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 93.370142][ T38] audit: type=1400 audit(1705956654.632:208): avc: denied { open } for pid=5399 comm="syz-execprog" path="/dev/raw-gadget" dev="devtmpfs" ino=760 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 93.386141][ T38] audit: type=1400 audit(1705956654.682:209): avc: denied { mounton } for pid=5406 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 93.402442][ T38] audit: type=1400 audit(1705956654.682:210): avc: denied { mount } for pid=5406 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 93.415301][ T38] audit: type=1400 audit(1705956654.692:211): avc: denied { setattr } for pid=5406 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=760 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 93.424684][ T38] audit: type=1400 audit(1705956654.712:212): avc: denied { read write } for pid=5406 comm="syz-executor" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 93.436569][ T38] audit: type=1400 audit(1705956654.712:213): avc: denied { open } for pid=5406 comm="syz-executor" path="/swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 95.404217][ T5406] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
2024/01/22 20:50:56 executed programs: 0
[ 95.474028][ T4603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.481461][ T4603] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.486424][ T4603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.499489][ T4603] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.505029][ T4603] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 95.514017][ T4603] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 95.732810][ T5415] chnl_net:caif_netlink_parms(): no params data found
[ 95.860521][ T5415] bridge0: port 1(bridge_slave_0) entered blocking state
[ 95.864132][ T5415] bridge0: port 1(bridge_slave_0) entered disabled state
[ 95.867358][ T5415] bridge_slave_0: entered allmulticast mode
[ 95.871716][ T5415] bridge_slave_0: entered promiscuous mode
[ 95.879337][ T5415] bridge0: port 2(bridge_slave_1) entered blocking state
[ 95.882878][ T5415] bridge0: port 2(bridge_slave_1) entered disabled state
[ 95.886086][ T5415] bridge_slave_1: entered allmulticast mode
[ 95.890396][ T5415] bridge_slave_1: entered promiscuous mode
[ 95.960037][ T5415] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 95.969076][ T5415] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.061519][ T5415] team0: Port device team_slave_0 added
[ 96.068940][ T5415] team0: Port device team_slave_1 added
[ 96.148345][ T5415] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.152000][ T5415] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.164875][ T5415] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.172695][ T5415] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.177150][ T5415] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.189227][ T5415] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.272608][ T5415] hsr_slave_0: entered promiscuous mode
[ 96.276212][ T5415] hsr_slave_1: entered promiscuous mode
[ 97.048096][ T5415] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 97.059019][ T5415] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 97.071102][ T5415] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 97.083089][ T5415] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 97.176060][ T5415] 8021q: adding VLAN 0 to HW filter on device bond0
[ 97.196699][ T5415] 8021q: adding VLAN 0 to HW filter on device team0
[ 97.205752][ T5201] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.209340][ T5201] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.224297][ T816] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.227745][ T816] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.426006][ T5415] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 97.473385][ T5415] veth0_vlan: entered promiscuous mode
[ 97.484205][ T5415] veth1_vlan: entered promiscuous mode
[ 97.521864][ T5415] veth0_macvtap: entered promiscuous mode
[ 97.527408][ T5415] veth1_macvtap: entered promiscuous mode
[ 97.540269][ T5415] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 97.552903][ T5415] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 97.562266][ T5189] Bluetooth: hci0: command 0x0409 tx timeout
[ 97.563072][ T5415] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.570132][ T5415] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.576317][ T5415] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.581207][ T5415] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.662311][ T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.666971][ T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.701021][ T825] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.706258][ T825] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 98.043148][ T825] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 98.444091][ T825] usb 5-1: config 0 has an invalid interface number: 108 but max is 0
[ 98.449005][ T825] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 98.453707][ T825] usb 5-1: config 0 has no interface number 0
[ 98.456574][ T825] usb 5-1: config 0 interface 108 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[ 98.461657][ T825] usb 5-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=2f.86
[ 98.467064][ T825] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 98.476843][ T825] usb 5-1: config 0 descriptor??
[ 98.517175][ T825] em28xx 5-1:0.108: New device @ 480 Mbps (2040:8265, interface 108, class 108)
[ 98.521719][ T825] em28xx 5-1:0.108: Audio interface 108 found (Vendor Class)
[ 98.844805][ T825] em28xx 5-1:0.108: unknown em28xx chip ID (0)
[ 98.852309][ T38] kauditd_printk_skb: 7 callbacks suppressed
[ 98.852318][ T38] audit: type=1400 audit(1705956660.152:221): avc: denied { search } for pid=4642 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 98.865007][ T825] em28xx 5-1:0.108: Config register raw data: 0xfffffffb
[ 98.901609][ T825] em28xx 5-1:0.108: AC97 chip type couldn't be determined
[ 98.905136][ T825] em28xx 5-1:0.108: No AC97 audio processor
[ 98.908140][ T825] em28xx 5-1:0.108: We currently don't support analog TV or stream capture on dual tuners.
[ 99.061158][ T825] em28xx 5-1:0.108: unknown em28xx chip ID (0)
[ 99.081015][ T825] em28xx 5-1:0.108: Config register raw data: 0xfffffffb
[ 99.111174][ T825] em28xx 5-1:0.108: AC97 chip type couldn't be determined
[ 99.114452][ T825] em28xx 5-1:0.108: No AC97 audio processor
[ 99.397541][ T825] usb 5-1: USB disconnect, device number 2
[ 99.403281][ T825] em28xx 5-1:0.108: Disconnecting em28xx #1
[ 99.406615][ T825] em28xx 5-1:0.108: Disconnecting em28xx
[ 99.416487][ T825] em28xx 5-1:0.108: Freeing device
[ 99.419085][ T825] em28xx 5-1:0.108: Freeing device
[ 99.641848][ T5189] Bluetooth: hci0: command 0x041b tx timeout
[ 99.784464][ T825] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 100.240954][ T825] usb 5-1: config 0 has an invalid interface number: 108 but max is 0
[ 100.245132][ T825] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 100.250129][ T825] usb 5-1: config 0 has no interface number 0
[ 100.253137][ T825] usb 5-1: config 0 interface 108 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[ 100.258916][ T825] usb 5-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=2f.86
[ 100.262739][ T825] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 100.268457][ T825] usb 5-1: config 0 descriptor??
[ 100.314017][ T825] em28xx 5-1:0.108: New device @ 480 Mbps (2040:8265, interface 108, class 108)
[ 100.317945][ T825] em28xx 5-1:0.108: Audio interface 108 found (Vendor Class)
[ 100.711049][ T825] em28xx 5-1:0.108: unknown em28xx chip ID (0)
[ 100.741834][ T825] em28xx 5-1:0.108: Config register raw data: 0xfffffffb
[ 100.771227][ T825] em28xx 5-1:0.108: AC97 chip type couldn't be determined
[ 100.775319][ T825] em28xx 5-1:0.108: No AC97 audio processor
[ 100.778793][ T825] ==================================================================
[ 100.782486][ T825] BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0xe0/0x100
[ 100.786621][ T825] Read of size 8 at addr ffff8880286d0250 by task kworker/2:2/825
[ 100.794452][ T825]
[ 100.795702][ T825] CPU: 2 PID: 825 Comm: kworker/2:2 Not tainted 6.8.0-rc1-syzkaller-g610347effc2e #0
[ 100.800212][ T825] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 100.805222][ T825] Workqueue: usb_hub_wq hub_event
[ 100.809083][ T825] Call Trace:
[ 100.810779][ T825]
[ 100.812262][ T825] dump_stack_lvl+0xd9/0x1b0
[ 100.814649][ T825] print_report+0xc4/0x620
[ 100.817566][ T825] ? __virt_addr_valid+0x5e/0x580
[ 100.820216][ T825] ? __phys_addr+0xc6/0x140
[ 100.822922][ T825] kasan_report+0xda/0x110
[ 100.825291][ T825] ? __list_add_valid_or_report+0xe0/0x100
[ 100.828272][ T825] ? __list_add_valid_or_report+0xe0/0x100
[ 100.830613][ T825] __list_add_valid_or_report+0xe0/0x100
[ 100.832848][ T825] em28xx_init_extension+0x48/0x1f0
[ 100.834773][ T825] em28xx_init_dev.constprop.0+0x1977/0x3080
[ 100.837228][ T825] ? em28xx_usb_disconnect+0x640/0x640
[ 100.840114][ T825] ? lockdep_init_map_type+0x16d/0x7d0
[ 100.842578][ T825] ? lockdep_init_map_type+0x16d/0x7d0
[ 100.844869][ T825] ? __raw_spin_lock_init+0x3a/0x110
[ 100.847454][ T825] em28xx_usb_probe+0x10d7/0x3730
[ 100.850101][ T825] usb_probe_interface+0x307/0x930
[ 100.852567][ T825] ? usb_match_dynamic_id+0x1a0/0x1a0
[ 100.855134][ T825] really_probe+0x234/0xc90
[ 100.857427][ T825] __driver_probe_device+0x1de/0x4b0
[ 100.860371][ T825] driver_probe_device+0x4c/0x1a0
[ 100.863348][ T825] __device_attach_driver+0x1d4/0x300
[ 100.865926][ T825] ? driver_probe_device+0x1a0/0x1a0
[ 100.868080][ T825] bus_for_each_drv+0x157/0x1d0
[ 100.870011][ T825] ? bus_for_each_dev+0x1d0/0x1d0
[ 100.872170][ T825] ? lockdep_hardirqs_on+0x7d/0x110
[ 100.874506][ T825] ? _raw_spin_unlock_irqrestore+0x3b/0x70
[ 100.877214][ T825] __device_attach+0x1e8/0x4b0
[ 100.879451][ T825] ? device_driver_attach+0x200/0x200
[ 100.881755][ T825] ? do_raw_spin_unlock+0x173/0x230
[ 100.884063][ T825] bus_probe_device+0x17c/0x1c0
[ 100.886197][ T825] device_add+0x117e/0x1aa0
[ 100.888063][ T825] ? __fw_devlink_link_to_consumers.isra.0+0x270/0x270
[ 100.891240][ T825] ? mark_held_locks+0x9f/0xe0
[ 100.894427][ T825] usb_set_configuration+0x10cb/0x1c40
[ 100.896969][ T825] ? usb_choose_configuration+0x9f0/0x9f0
[ 100.899600][ T825] usb_generic_driver_probe+0xad/0x110
[ 100.902195][ T825] usb_probe_device+0xec/0x350
[ 100.904680][ T825] ? usb_driver_release_interface+0x190/0x190
[ 100.908900][ T825] really_probe+0x234/0xc90
[ 100.910925][ T825] __driver_probe_device+0x1de/0x4b0
[ 100.913303][ T825] ? usb_driver_applicable+0x1c4/0x220
[ 100.915941][ T825] driver_probe_device+0x4c/0x1a0
[ 100.918218][ T825] __device_attach_driver+0x1d4/0x300
[ 100.920687][ T825] ? driver_probe_device+0x1a0/0x1a0
[ 100.923173][ T825] bus_for_each_drv+0x157/0x1d0
[ 100.925382][ T825] ? bus_for_each_dev+0x1d0/0x1d0
[ 100.927842][ T825] ? lockdep_hardirqs_on+0x7d/0x110
[ 100.930248][ T825] ? _raw_spin_unlock_irqrestore+0x3b/0x70
[ 100.932930][ T825] __device_attach+0x1e8/0x4b0
[ 100.935111][ T825] ? device_driver_attach+0x200/0x200
[ 100.937685][ T825] ? do_raw_spin_unlock+0x173/0x230
[ 100.939864][ T825] bus_probe_device+0x17c/0x1c0
[ 100.942037][ T825] device_add+0x117e/0x1aa0
[ 100.943930][ T825] ? __fw_devlink_link_to_consumers.isra.0+0x270/0x270
[ 100.946816][ T825] ? usb_detect_static_quirks+0x335/0x3e0
[ 100.949516][ T825] usb_new_device+0xd80/0x19f0
[ 100.951936][ T825] ? hub_disconnect+0x520/0x520
[ 100.954548][ T825] hub_event+0x2dac/0x4e10
[ 100.956912][ T825] ? hub_port_debounce+0x3d0/0x3d0
[ 100.959283][ T825] ? check_irq_usage+0x11f1/0x1490
[ 100.961631][ T825] ? lock_sync+0x190/0x190
[ 100.963517][ T825] ? reacquire_held_locks+0x4c0/0x4c0
[ 100.965778][ T825] process_one_work+0x886/0x15d0
[ 100.967818][ T825] ? hub_port_debounce+0x3d0/0x3d0
[ 100.970350][ T825] ? workqueue_congested+0x300/0x300
[ 100.973461][ T825] ? assign_work+0x1a0/0x250
[ 100.975902][ T825] worker_thread+0x8b9/0x1290
[ 100.978505][ T825] ? __kthread_parkme+0x14b/0x220
[ 100.980848][ T825] ? process_one_work+0x15d0/0x15d0
[ 100.983422][ T825] kthread+0x2c6/0x3a0
[ 100.985667][ T825] ? _raw_spin_unlock_irq+0x23/0x50
[ 100.988222][ T825] ? kthread_complete_and_exit+0x40/0x40
[ 100.991249][ T825] ret_from_fork+0x45/0x80
[ 100.994435][ T825] ? kthread_complete_and_exit+0x40/0x40
[ 100.997395][ T825] ret_from_fork_asm+0x11/0x20
[ 100.999469][ T825]
[ 101.001023][ T825]
[ 101.002093][ T825] Allocated by task 5531:
[ 101.004238][ T825] kasan_save_stack+0x33/0x50
[ 101.006617][ T825] kasan_save_track+0x14/0x30
[ 101.008706][ T825] __kasan_slab_alloc+0x81/0x90
[ 101.010663][ T825] kmem_cache_alloc_bulk+0x435/0x940
[ 101.012975][ T825] mas_alloc_nodes+0x39b/0x860
[ 101.015323][ T825] mas_node_count_gfp+0x105/0x130
[ 101.017870][ T825] mas_preallocate+0x3bb/0x1010
[ 101.020351][ T825] __split_vma+0x477/0x1190
[ 101.022776][ T825] do_vmi_align_munmap+0x35f/0x1ad0
[ 101.025279][ T825] do_vmi_munmap+0x20e/0x450
[ 101.027717][ T825] mmap_region+0x17f/0x2aa0
[ 101.029855][ T825] do_mmap+0x893/0xef0
[ 101.031470][ T825] vm_mmap_pgoff+0x1a8/0x3c0
[ 101.033449][ T825] ksys_mmap_pgoff+0x422/0x5b0
[ 101.035808][ T825] __x64_sys_mmap+0x125/0x190
[ 101.038047][ T825] do_syscall_64+0xd3/0x250
[ 101.040037][ T825] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 101.042926][ T825]
[ 101.044090][ T825] Freed by task 16:
[ 101.045717][ T825] kasan_save_stack+0x33/0x50
[ 101.047733][ T825] kasan_save_track+0x14/0x30
[ 101.049613][ T825] kasan_save_free_info+0x3f/0x60
[ 101.051932][ T825] __kasan_slab_free+0x121/0x1b0
[ 101.054507][ T825] kmem_cache_free+0x129/0x350
[ 101.057854][ T825] rcu_core+0x819/0x1680
[ 101.059477][ T825] __do_softirq+0x21a/0x8de
[ 101.061101][ T825]
[ 101.061959][ T825] Last potentially related work creation:
[ 101.064742][ T825] kasan_save_stack+0x33/0x50
[ 101.066785][ T825] __kasan_record_aux_stack+0xba/0x100
[ 101.068970][ T825] __call_rcu_common.constprop.0+0x9a/0x7b0
[ 101.071512][ T825] mas_topiary_replace+0x171e/0x3600
[ 101.074290][ T825] mas_split.isra.0+0xab8/0x11a0
[ 101.076932][ T825] mas_commit_b_node.isra.0+0x894/0x14e0
[ 101.079449][ T825] mas_wr_bnode+0x187/0x220
[ 101.081375][ T825] mas_wr_store_entry.isra.0+0x6c4/0x1610
[ 101.083764][ T825] mas_store_prealloc+0xb6/0x2a0
[ 101.085930][ T825] vma_complete+0x8ff/0xdf0
[ 101.088213][ T825] __split_vma+0xd66/0x1190
[ 101.090895][ T825] do_vmi_align_munmap+0x2c2/0x1ad0
[ 101.093841][ T825] do_vmi_munmap+0x20e/0x450
[ 101.096151][ T825] mmap_region+0x17f/0x2aa0
[ 101.098248][ T825] do_mmap+0x893/0xef0
[ 101.100307][ T825] vm_mmap_pgoff+0x1a8/0x3c0
[ 101.102478][ T825] ksys_mmap_pgoff+0x422/0x5b0
[ 101.104732][ T825] __x64_sys_mmap+0x125/0x190
[ 101.106930][ T825] do_syscall_64+0xd3/0x250
[ 101.109622][ T825] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 101.113420][ T825]
[ 101.114506][ T825] The buggy address belongs to the object at ffff8880286d0200
[ 101.114506][ T825] which belongs to the cache maple_node of size 256
[ 101.120110][ T825] The buggy address is located 80 bytes inside of
[ 101.120110][ T825] freed 256-byte region [ffff8880286d0200, ffff8880286d0300)
[ 101.126706][ T825]
[ 101.127925][ T825] The buggy address belongs to the physical page:
[ 101.130807][ T825] page:ffffea0000a1b400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x286d0
[ 101.135298][ T825] head:ffffea0000a1b400 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 101.139729][ T825] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 101.144651][ T825] page_type: 0xffffffff()
[ 101.146682][ T825] raw: 00fff00000000840 ffff888013050c80 dead000000000122 0000000000000000
[ 101.150645][ T825] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 101.154474][ T825] page dumped because: kasan: bad access detected
[ 101.157193][ T825] page_owner tracks the page as allocated
[ 101.159723][ T825] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5531, tgid 5531 (rm), ts 100041590403, free_ts 99419016782
[ 101.170340][ T825] post_alloc_hook+0x2d0/0x350
[ 101.172526][ T825] get_page_from_freelist+0xa28/0x3780
[ 101.175062][ T825] __alloc_pages+0x22f/0x2440
[ 101.177094][ T825] new_slab+0xcc/0x3a0
[ 101.178959][ T825] ___slab_alloc+0x4af/0x19a0
[ 101.181575][ T825] kmem_cache_alloc_bulk+0x27a/0x940
[ 101.184461][ T825] mas_alloc_nodes+0x39b/0x860
[ 101.186688][ T825] mas_node_count_gfp+0x105/0x130
[ 101.189030][ T825] mas_preallocate+0x3bb/0x1010
[ 101.191292][ T825] __split_vma+0x477/0x1190
[ 101.193168][ T825] do_vmi_align_munmap+0x35f/0x1ad0
[ 101.195303][ T825] do_vmi_munmap+0x20e/0x450
[ 101.197357][ T825] mmap_region+0x17f/0x2aa0
[ 101.199761][ T825] do_mmap+0x893/0xef0
[ 101.201923][ T825] vm_mmap_pgoff+0x1a8/0x3c0
[ 101.204367][ T825] ksys_mmap_pgoff+0x422/0x5b0
[ 101.206370][ T825] page last free pid 825 tgid 825 stack trace:
[ 101.209170][ T825] free_unref_page_prepare+0x51f/0xb10
[ 101.211912][ T825] free_unref_page+0x33/0x3c0
[ 101.213973][ T825] __folio_put+0xeb/0x110
[ 101.215670][ T825] em28xx_usb_disconnect+0x4eb/0x640
[ 101.217905][ T825] usb_unbind_interface+0x1dd/0x8d0
[ 101.220574][ T825] device_remove+0x11f/0x170
[ 101.222818][ T825] device_release_driver_internal+0x44a/0x610
[ 101.225772][ T825] bus_remove_device+0x22c/0x420
[ 101.228052][ T825] device_del+0x39a/0xa50
[ 101.229848][ T825] usb_disable_device+0x36c/0x7f0
[ 101.231878][ T825] usb_disconnect+0x2e1/0x910
[ 101.233579][ T825] hub_event+0x1db7/0x4e10
[ 101.235693][ T825] process_one_work+0x886/0x15d0
[ 101.238904][ T825] worker_thread+0x8b9/0x1290
[ 101.241408][ T825] kthread+0x2c6/0x3a0
[ 101.242918][ T825] ret_from_fork+0x45/0x80
[ 101.244916][ T825]
[ 101.245997][ T825] Memory state around the buggy address:
[ 101.248593][ T825] ffff8880286d0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 101.252278][ T825] ffff8880286d0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 101.256271][ T825] >ffff8880286d0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 101.260243][ T825] ^
[ 101.263043][ T825] ffff8880286d0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 101.266529][ T825] ffff8880286d0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 101.270324][ T825] ==================================================================
[ 101.280540][ T825] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 101.283440][ T825] CPU: 2 PID: 825 Comm: kworker/2:2 Not tainted 6.8.0-rc1-syzkaller-g610347effc2e #0
[ 101.288637][ T825] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 101.294326][ T825] Workqueue: usb_hub_wq hub_event
[ 101.297088][ T825] Call Trace:
[ 101.298623][ T825]
[ 101.299989][ T825] dump_stack_lvl+0xd9/0x1b0
[ 101.302131][ T825] panic+0x6dc/0x790
[ 101.303959][ T825] ? panic_smp_self_stop+0xa0/0xa0
[ 101.306001][ T825] ? irqentry_exit+0x3b/0x80
[ 101.308071][ T825] ? lockdep_hardirqs_on+0x7d/0x110
[ 101.310237][ T825] ? preempt_schedule_thunk+0x1a/0x30
[ 101.312518][ T825] ? preempt_schedule_common+0x45/0xc0
[ 101.315021][ T825] ? check_panic_on_warn+0x1f/0xb0
[ 101.318177][ T825] check_panic_on_warn+0xab/0xb0
[ 101.320484][ T825] end_report+0x108/0x150
[ 101.322307][ T825] kasan_report+0xea/0x110
[ 101.324204][ T825] ? __list_add_valid_or_report+0xe0/0x100
[ 101.326514][ T825] ? __list_add_valid_or_report+0xe0/0x100
[ 101.328696][ T825] __list_add_valid_or_report+0xe0/0x100
[ 101.331004][ T825] em28xx_init_extension+0x48/0x1f0
[ 101.333066][ T825] em28xx_init_dev.constprop.0+0x1977/0x3080
[ 101.335843][ T825] ? em28xx_usb_disconnect+0x640/0x640
[ 101.338251][ T825] ? lockdep_init_map_type+0x16d/0x7d0
[ 101.341034][ T825] ? lockdep_init_map_type+0x16d/0x7d0
[ 101.343052][ T825] ? __raw_spin_lock_init+0x3a/0x110
[ 101.345121][ T825] em28xx_usb_probe+0x10d7/0x3730
[ 101.347479][ T825] usb_probe_interface+0x307/0x930
[ 101.349620][ T825] ? usb_match_dynamic_id+0x1a0/0x1a0
[ 101.352058][ T825] really_probe+0x234/0xc90
[ 101.353929][ T825] __driver_probe_device+0x1de/0x4b0
[ 101.356311][ T825] driver_probe_device+0x4c/0x1a0
[ 101.358568][ T825] __device_attach_driver+0x1d4/0x300
[ 101.360885][ T825] ? driver_probe_device+0x1a0/0x1a0
[ 101.363189][ T825] bus_for_each_drv+0x157/0x1d0
[ 101.365788][ T825] ? bus_for_each_dev+0x1d0/0x1d0
[ 101.368097][ T825] ? lockdep_hardirqs_on+0x7d/0x110
[ 101.370500][ T825] ? _raw_spin_unlock_irqrestore+0x3b/0x70
[ 101.373925][ T825] __device_attach+0x1e8/0x4b0
[ 101.377215][ T825] ? device_driver_attach+0x200/0x200
[ 101.379749][ T825] ? do_raw_spin_unlock+0x173/0x230
[ 101.382130][ T825] bus_probe_device+0x17c/0x1c0
[ 101.384461][ T825] device_add+0x117e/0x1aa0
[ 101.386725][ T825] ? __fw_devlink_link_to_consumers.isra.0+0x270/0x270
[ 101.390058][ T825] ? mark_held_locks+0x9f/0xe0
[ 101.392258][ T825] usb_set_configuration+0x10cb/0x1c40
[ 101.394564][ T825] ? usb_choose_configuration+0x9f0/0x9f0
[ 101.396957][ T825] usb_generic_driver_probe+0xad/0x110
[ 101.399705][ T825] usb_probe_device+0xec/0x350
[ 101.402137][ T825] ? usb_driver_release_interface+0x190/0x190
[ 101.404412][ T825] really_probe+0x234/0xc90
[ 101.406119][ T825] __driver_probe_device+0x1de/0x4b0
[ 101.408390][ T825] ? usb_driver_applicable+0x1c4/0x220
[ 101.410630][ T825] driver_probe_device+0x4c/0x1a0
[ 101.413789][ T825] __device_attach_driver+0x1d4/0x300
[ 101.416530][ T825] ? driver_probe_device+0x1a0/0x1a0
[ 101.418905][ T825] bus_for_each_drv+0x157/0x1d0
[ 101.421132][ T825] ? bus_for_each_dev+0x1d0/0x1d0
[ 101.423436][ T825] ? lockdep_hardirqs_on+0x7d/0x110
[ 101.425823][ T825] ? _raw_spin_unlock_irqrestore+0x3b/0x70
[ 101.428512][ T825] __device_attach+0x1e8/0x4b0
[ 101.430759][ T825] ? device_driver_attach+0x200/0x200
[ 101.433355][ T825] ? do_raw_spin_unlock+0x173/0x230
[ 101.436106][ T825] bus_probe_device+0x17c/0x1c0
[ 101.438233][ T825] device_add+0x117e/0x1aa0
[ 101.440322][ T825] ? __fw_devlink_link_to_consumers.isra.0+0x270/0x270
[ 101.443314][ T825] ? usb_detect_static_quirks+0x335/0x3e0
[ 101.445999][ T825] usb_new_device+0xd80/0x19f0
[ 101.448233][ T825] ? hub_disconnect+0x520/0x520
[ 101.450314][ T825] hub_event+0x2dac/0x4e10
[ 101.452245][ T825] ? hub_port_debounce+0x3d0/0x3d0
[ 101.454646][ T825] ? check_irq_usage+0x11f1/0x1490
[ 101.457331][ T825] ? lock_sync+0x190/0x190
[ 101.459460][ T825] ? reacquire_held_locks+0x4c0/0x4c0
[ 101.461971][ T825] process_one_work+0x886/0x15d0
[ 101.464245][ T825] ? hub_port_debounce+0x3d0/0x3d0
[ 101.466784][ T825] ? workqueue_congested+0x300/0x300
[ 101.469415][ T825] ? assign_work+0x1a0/0x250
[ 101.471758][ T825] worker_thread+0x8b9/0x1290
[ 101.474476][ T825] ? __kthread_parkme+0x14b/0x220
[ 101.476735][ T825] ? process_one_work+0x15d0/0x15d0
[ 101.478842][ T825] kthread+0x2c6/0x3a0
[ 101.480650][ T825] ? _raw_spin_unlock_irq+0x23/0x50
[ 101.483234][ T825] ? kthread_complete_and_exit+0x40/0x40
[ 101.485759][ T825] ret_from_fork+0x45/0x80
[ 101.487900][ T825] ? kthread_complete_and_exit+0x40/0x40
[ 101.490609][ T825] ret_from_fork_asm+0x11/0x20
[ 101.492925][ T825]
[ 101.495098][ T825] Kernel Offset: disabled
[ 101.497071][ T825] Rebooting in 86400 seconds..
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)
KVM: injection failed, MSI lost (Operation not permitted)