Warning: Permanently added '10.128.1.184' (ED25519) to the list of known hosts. 2026/10/27 07:10:52 parsed 1 programs 2026/10/27 07:10:52 serving rpc on tcp://37237 Setting up swapspace version 1, size = 127995904 bytes [ 66.458305][ T4084] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.744677][ T4127] veth0_vlan: entered promiscuous mode [ 73.162206][ T346] veth0_vlan: left promiscuous mode 2026/10/27 07:11:00 executed programs: 0 [ 76.039422][ T4334] veth0_vlan: entered promiscuous mode [ 76.769334][ T4523] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 76.769987][ T4523] udc dummy_udc.0: failed to start g1: -19 [ 76.770627][ T4523] UDC core: g1: couldn't find an available UDC or it's busy [ 76.824023][ T4526] ================================================================== [ 76.824032][ T4526] BUG: KASAN: slab-use-after-free in filp_flush+0x2c/0x140 [ 76.824049][ T4526] Read of size 8 at addr ffff88802db7cd90 by task syz.2.18/4526 [ 76.824055][ T4526] [ 76.824073][ T4526] CPU: 1 UID: 0 PID: 4526 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPT_{RT,(lazy)} [ 76.824081][ T4526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 76.824092][ T4526] Call Trace: [ 76.824099][ T4526] [ 76.824102][ T4526] dump_stack_lvl+0x52/0x80 [ 76.824110][ T4526] print_address_description+0x55/0x1e0 [ 76.824120][ T4526] ? filp_flush+0x2c/0x140 [ 76.824126][ T4526] print_report+0x58/0x70 [ 76.824133][ T4526] kasan_report+0x117/0x150 [ 76.824144][ T4526] ? filp_flush+0x2c/0x140 [ 76.824152][ T4526] kasan_check_range+0x264/0x2c0 [ 76.824172][ T4526] filp_flush+0x2c/0x140 [ 76.824180][ T4526] filp_close+0xe/0x30 [ 76.824187][ T4526] gaudio_cleanup+0x4b/0xc0 [ 76.824195][ T4526] f_audio_bind+0x44e/0x640 [ 76.824203][ T4526] ? __pfx_f_audio_bind+0x10/0x10 [ 76.824211][ T4526] ? rcu_is_watching+0x20/0xa0 [ 76.824218][ T4526] ? usb_gadget_set_selfpowered+0x9e/0x160 [ 76.824228][ T4526] usb_add_function+0x221/0x780 [ 76.824236][ T4526] configfs_composite_bind+0xcc9/0x12d0 [ 76.824244][ T4526] ? __pfx_configfs_composite_bind+0x10/0x10 [ 76.824251][ T4526] gadget_bind_driver+0x27d/0x8c0 [ 76.824259][ T4526] really_probe+0x2d2/0x9d0 [ 76.824267][ T4526] __driver_probe_device+0x17a/0x2c0 [ 76.824275][ T4526] driver_probe_device+0x4a/0x1e0 [ 76.824282][ T4526] __driver_attach+0x18e/0x4e0 [ 76.824289][ T4526] ? __pfx___driver_attach+0x10/0x10 [ 76.824297][ T4526] bus_for_each_dev+0x224/0x290 [ 76.824304][ T4526] ? __pfx_bus_for_each_dev+0x10/0x10 [ 76.824311][ T4526] ? rt_spin_unlock+0x122/0x1b0 [ 76.824319][ T4526] bus_add_driver+0x317/0x5e0 [ 76.824327][ T4526] driver_register+0x16e/0x2b0 [ 76.824335][ T4526] usb_gadget_register_driver_owner+0xf9/0x210 [ 76.824343][ T4526] gadget_dev_desc_UDC_store+0x121/0x250 [ 76.824350][ T4526] configfs_write_iter+0x2f9/0x3e0 [ 76.824358][ T4526] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 76.824365][ T4526] vfs_write+0x5a6/0xcb0 [ 76.824372][ T4526] ? __pfx_vfs_write+0x10/0x10 [ 76.824379][ T4526] ? do_raw_spin_unlock+0xf5/0x200 [ 76.824385][ T4526] ? fdget_pos+0x1d3/0x290 [ 76.824393][ T4526] ? mutex_lock_nested+0x10e/0x180 [ 76.824400][ T4526] ksys_write+0x116/0x1f0 [ 76.824406][ T4526] ? __pfx_ksys_write+0x10/0x10 [ 76.824413][ T4526] ? switch_fpu_return+0xe5/0x180 [ 76.824420][ T4526] do_syscall_64+0xe7/0x390 [ 76.824427][ T4526] ? clear_bhb_loop+0x70/0xc0 [ 76.824438][ T4526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.824443][ T4526] RIP: 0033:0x7f25eb5ee0d9 [ 76.824454][ T4526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.824460][ T4526] RSP: 002b:00007f25eb44f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 76.824469][ T4526] RAX: ffffffffffffffda RBX: 00007f25eb875fa0 RCX: 00007f25eb5ee0d9 [ 76.824473][ T4526] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 76.824477][ T4526] RBP: 00007f25eb685024 R08: 0000000000000000 R09: 0000000000000000 [ 76.824480][ T4526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.824484][ T4526] R13: 00007f25eb876038 R14: 00007f25eb875fa0 R15: 00007ffd618b1a58 [ 76.824490][ T4526] [ 76.824492][ T4526] [ 76.824494][ T4526] Allocated by task 4523: [ 76.824498][ T4526] kasan_save_track+0x3e/0x80 [ 76.824504][ T4526] __kasan_slab_alloc+0x6c/0x80 [ 76.824509][ T4526] kmem_cache_alloc_noprof+0x2f6/0x5d0 [ 76.824516][ T4526] alloc_empty_file+0x3f/0x170 [ 76.824522][ T4526] path_openat+0x84/0x16e0 [ 76.824528][ T4526] do_file_open+0x21b/0x460 [ 76.824532][ T4526] filp_open+0x10f/0x170 [ 76.824538][ T4526] gaudio_setup+0x114/0xf60 [ 76.824543][ T4526] f_audio_bind+0x137/0x640 [ 76.824549][ T4526] usb_add_function+0x221/0x780 [ 76.824554][ T4526] configfs_composite_bind+0xcc9/0x12d0 [ 76.824560][ T4526] gadget_bind_driver+0x27d/0x8c0 [ 76.824565][ T4526] really_probe+0x2d2/0x9d0 [ 76.824570][ T4526] __driver_probe_device+0x17a/0x2c0 [ 76.824575][ T4526] driver_probe_device+0x4a/0x1e0 [ 76.824581][ T4526] __driver_attach+0x18e/0x4e0 [ 76.824586][ T4526] bus_for_each_dev+0x224/0x290 [ 76.824590][ T4526] bus_add_driver+0x317/0x5e0 [ 76.824595][ T4526] driver_register+0x16e/0x2b0 [ 76.824601][ T4526] usb_gadget_register_driver_owner+0xf9/0x210 [ 76.824605][ T4526] gadget_dev_desc_UDC_store+0x121/0x250 [ 76.824611][ T4526] configfs_write_iter+0x2f9/0x3e0 [ 76.824616][ T4526] vfs_write+0x5a6/0xcb0 [ 76.824619][ T4526] ksys_write+0x116/0x1f0 [ 76.824624][ T4526] do_syscall_64+0xe7/0x390 [ 76.824630][ T4526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.824635][ T4526] [ 76.824637][ T4526] Freed by task 28: [ 76.824640][ T4526] kasan_save_track+0x3e/0x80 [ 76.824645][ T4526] kasan_save_free_info+0x40/0x50 [ 76.824653][ T4526] __kasan_slab_free+0x5c/0x80 [ 76.824658][ T4526] slab_free_after_rcu_debug+0x136/0x210 [ 76.824665][ T4526] rcu_cpu_kthread+0xdad/0x2010 [ 76.824673][ T4526] smpboot_thread_fn+0x452/0x820 [ 76.824679][ T4526] kthread+0x2e3/0x3b0 [ 76.824685][ T4526] ret_from_fork+0x29c/0x620 [ 76.824693][ T4526] ret_from_fork_asm+0x1a/0x30 [ 76.824698][ T4526] [ 76.824699][ T4526] Last potentially related work creation: [ 76.824702][ T4526] kasan_save_stack+0x3e/0x60 [ 76.824707][ T4526] kasan_record_aux_stack+0xbd/0xd0 [ 76.824713][ T4526] kmem_cache_free+0x4b4/0x5e0 [ 76.824719][ T4526] task_work_run+0x151/0x1e0 [ 76.824725][ T4526] exit_to_user_mode_loop+0x1e1/0x6d0 [ 76.824731][ T4526] do_syscall_64+0x1d2/0x390 [ 76.824736][ T4526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.824740][ T4526] [ 76.824742][ T4526] Second to last potentially related work creation: [ 76.824745][ T4526] kasan_save_stack+0x3e/0x60 [ 76.824749][ T4526] kasan_record_aux_stack+0xbd/0xd0 [ 76.824755][ T4526] task_work_add+0x99/0x2c0 [ 76.824760][ T4526] __fput_deferred+0x134/0x320 [ 76.824765][ T4526] fput_close+0xe3/0x190 [ 76.824771][ T4526] filp_close+0x18/0x30 [ 76.824776][ T4526] gaudio_cleanup+0x4b/0xc0 [ 76.824781][ T4526] f_audio_bind+0x44e/0x640 [ 76.824787][ T4526] usb_add_function+0x221/0x780 [ 76.824791][ T4526] configfs_composite_bind+0xcc9/0x12d0 [ 76.824797][ T4526] gadget_bind_driver+0x27d/0x8c0 [ 76.824801][ T4526] really_probe+0x2d2/0x9d0 [ 76.824807][ T4526] __driver_probe_device+0x17a/0x2c0 [ 76.824812][ T4526] driver_probe_device+0x4a/0x1e0 [ 76.824816][ T4526] __driver_attach+0x18e/0x4e0 [ 76.824822][ T4526] bus_for_each_dev+0x224/0x290 [ 76.824827][ T4526] bus_add_driver+0x317/0x5e0 [ 76.824832][ T4526] driver_register+0x16e/0x2b0 [ 76.824838][ T4526] usb_gadget_register_driver_owner+0xf9/0x210 [ 76.824842][ T4526] gadget_dev_desc_UDC_store+0x121/0x250 [ 76.824848][ T4526] configfs_write_iter+0x2f9/0x3e0 [ 76.824852][ T4526] vfs_write+0x5a6/0xcb0 [ 76.824856][ T4526] ksys_write+0x116/0x1f0 [ 76.824860][ T4526] do_syscall_64+0xe7/0x390 [ 76.824865][ T4526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.824870][ T4526] [ 76.824872][ T4526] The buggy address belongs to the object at ffff88802db7cc00 [ 76.824872][ T4526] which belongs to the cache filp of size 408 [ 76.824878][ T4526] The buggy address is located 400 bytes inside of [ 76.824878][ T4526] freed 408-byte region [ffff88802db7cc00, ffff88802db7cd98) [ 76.824884][ T4526] [ 76.824886][ T4526] The buggy address belongs to the physical page: [ 76.824895][ T4526] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2db7c [ 76.824902][ T4526] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 76.824907][ T4526] memcg:ffff888028907e01 [ 76.824910][ T4526] flags: 0x80000000000040(head|node=0|zone=1) [ 76.824924][ T4526] page_type: f5(slab) [ 76.824931][ T4526] raw: 0080000000000040 ffff88801128a780 dead000000000100 dead000000000122 [ 76.824936][ T4526] raw: 0000000000000000 0000000200100010 00000000f5000000 ffff888028907e01 [ 76.824940][ T4526] head: 0080000000000040 ffff88801128a780 dead000000000100 dead000000000122 [ 76.824944][ T4526] head: 0000000000000000 0000000200100010 00000000f5000000 ffff888028907e01 [ 76.824948][ T4526] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 76.824953][ T4526] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 76.824956][ T4526] page dumped because: kasan: bad access detected [ 76.824964][ T4526] page_owner tracks the page as allocated [ 76.824967][ T4526] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3211, tgid 3211 (udevd), ts 11715049491 [ 76.824977][ T4526] post_alloc_hook+0x112/0x140 [ 76.824983][ T4526] get_page_from_freelist+0x2f7b/0x3000 [ 76.824997][ T4526] __alloc_frozen_pages_noprof+0x2ab/0x580 [ 76.825003][ T4526] allocate_slab+0x7c/0x540 [ 76.825008][ T4526] refill_objects+0x35b/0x3d0 [ 76.825013][ T4526] __pcs_replace_empty_main+0x36f/0x530 [ 76.825019][ T4526] kmem_cache_alloc_noprof+0x3e2/0x5d0 [ 76.825024][ T4526] alloc_empty_file+0x3f/0x170 [ 76.825031][ T4526] path_openat+0x84/0x16e0 [ 76.825036][ T4526] do_file_open+0x21b/0x460 [ 76.825041][ T4526] do_sys_openat2+0xfb/0x1b0 [ 76.825048][ T4526] __x64_sys_openat+0xf3/0x120 [ 76.825053][ T4526] do_syscall_64+0xe7/0x390 [ 76.825059][ T4526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.825065][ T4526] page_owner free stack trace missing [ 76.825067][ T4526] [ 76.825069][ T4526] Memory state around the buggy address: [ 76.825073][ T4526] ffff88802db7cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.825077][ T4526] ffff88802db7cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.825081][ T4526] >ffff88802db7cd80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.825084][ T4526] ^ [ 76.825087][ T4526] ffff88802db7ce00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.825091][ T4526] ffff88802db7ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.825094][ T4526] ================================================================== [ 76.825122][ T4526] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.818944][ T4526] Kernel Offset: disabled [ 77.823286][ T4526] Rebooting in 86400 seconds..