Warning: Permanently added '10.128.0.126' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://42401 [ 31.417045][ T4342] cgroup: Unknown subsys name 'net' [ 31.686748][ T4342] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.963635][ T4342] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 35.583059][ T4355] chnl_net:caif_netlink_parms(): no params data found [ 35.603501][ T4355] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.605172][ T4355] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.606808][ T4355] device bridge_slave_0 entered promiscuous mode [ 35.609272][ T4355] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.610516][ T4355] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.611957][ T4355] device bridge_slave_1 entered promiscuous mode [ 35.618531][ T4355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.620808][ T4355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.630524][ T4355] team0: Port device team_slave_0 added [ 35.632151][ T4355] team0: Port device team_slave_1 added [ 35.637770][ T4355] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.638989][ T4355] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.643225][ T4355] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.646154][ T4355] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.647310][ T4355] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.651576][ T4355] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.705846][ T4355] device hsr_slave_0 entered promiscuous mode [ 35.744461][ T4355] device hsr_slave_1 entered promiscuous mode [ 35.819035][ T4355] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.836990][ T4355] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.886087][ T4355] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.926587][ T4355] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.961385][ T4355] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.962739][ T4355] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.964103][ T4355] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.965432][ T4355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.983214][ T4355] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.988054][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.990687][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.992448][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.995064][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 35.999431][ T4355] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.002266][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.003871][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.005246][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.010792][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.012450][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.013640][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.020265][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 36.021884][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 36.026322][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 36.029241][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.032161][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.037317][ T4355] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 36.089134][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 36.090566][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 36.095221][ T4355] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.100669][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.107476][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.109287][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.110796][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.112899][ T4355] device veth0_vlan entered promiscuous mode [ 36.117691][ T4355] device veth1_vlan entered promiscuous mode [ 36.123947][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.126047][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.127731][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.130272][ T4355] device veth0_macvtap entered promiscuous mode [ 36.132767][ T4355] device veth1_macvtap entered promiscuous mode [ 36.139681][ T4355] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.141073][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.143005][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.147719][ T4355] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.149109][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.151717][ T4355] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.153049][ T4355] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.155445][ T4355] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.156873][ T4355] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.675969][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.750989][ T4385] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.752790][ T4385] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.755172][ T4385] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.756748][ T4385] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.758248][ T4385] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.759576][ T4385] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.232223][ T1580] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.233653][ T1580] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.238178][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 37.245240][ T1580] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.246663][ T1580] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.248325][ T1580] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:37 executed programs: 0 [ 37.729155][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.730842][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.732271][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.733737][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.735506][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 37.736942][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.780963][ T4426] chnl_net:caif_netlink_parms(): no params data found [ 37.797945][ T4426] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.799279][ T4426] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.800937][ T4426] device bridge_slave_0 entered promiscuous mode [ 37.803686][ T4426] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.805082][ T4426] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.806887][ T4426] device bridge_slave_1 entered promiscuous mode [ 37.813798][ T4426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.817646][ T4426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.824444][ T4426] team0: Port device team_slave_0 added [ 37.826273][ T4426] team0: Port device team_slave_1 added [ 37.832114][ T4426] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.833262][ T4426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.838616][ T4426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.841002][ T4426] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.842210][ T4426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.846682][ T4426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.885321][ T4426] device hsr_slave_0 entered promiscuous mode [ 37.934549][ T4426] device hsr_slave_1 entered promiscuous mode [ 37.974237][ T4426] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 37.975687][ T4426] Cannot create hsr debugfs directory [ 39.305309][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.764623][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 41.646031][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.746147][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.844455][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 42.795385][ T4426] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 42.845318][ T4426] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 42.926147][ T4426] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 42.965281][ T4426] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 43.076384][ T4426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.080254][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.081802][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.084823][ T4426] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.087300][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.088874][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.090552][ T1588] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.092148][ T1588] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.093701][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 43.127762][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.129476][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.131071][ T1588] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.132278][ T1588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.134904][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.137641][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 43.140322][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 43.142391][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.143994][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.147243][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.148944][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.151810][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.153471][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.157435][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.159118][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.161792][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.230463][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.231950][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.235480][ T4426] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.241015][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.242697][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.248098][ T9] device hsr_slave_0 left promiscuous mode [ 43.274600][ T9] device hsr_slave_1 left promiscuous mode [ 43.374801][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 43.376142][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 43.377970][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 43.379279][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.380746][ T9] device bridge_slave_1 left promiscuous mode [ 43.382168][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.424883][ T9] device bridge_slave_0 left promiscuous mode [ 43.425996][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.545316][ T9] device veth1_macvtap left promiscuous mode [ 43.546585][ T9] device veth0_macvtap left promiscuous mode [ 43.547647][ T9] device veth1_vlan left promiscuous mode [ 43.548599][ T9] device veth0_vlan left promiscuous mode [ 43.934507][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 45.715983][ T9] team0 (unregistering): Port device team_slave_1 removed [ 45.905365][ T9] team0 (unregistering): Port device team_slave_0 removed [ 46.004210][ T4385] Bluetooth: hci0: command 0x0419 tx timeout [ 46.084598][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 46.284794][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 47.874990][ T9] bond0 (unregistering): Released all slaves [ 48.191002][ T4426] device veth0_vlan entered promiscuous mode [ 48.193996][ T4426] device veth1_vlan entered promiscuous mode [ 48.202523][ T1580] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 48.204314][ T1580] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.205906][ T1580] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 48.207305][ T1580] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 48.209032][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.210825][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.216762][ T4426] device veth0_macvtap entered promiscuous mode [ 48.218973][ T4426] device veth1_macvtap entered promiscuous mode [ 48.223304][ T4426] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 48.225214][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 48.226943][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.228463][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 48.230060][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 48.231700][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.235358][ T4426] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 48.238209][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 48.239928][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 48.241570][ T1588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.243525][ T4426] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.247530][ T4426] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.248974][ T4426] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.250445][ T4426] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.279381][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 48.280823][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 48.282148][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 48.289316][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 48.290555][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 48.291912][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 48.365196][ T4495] vhci_hcd vhci_hcd.0: remove, state 4 [ 48.366311][ T4495] usb usb3: USB disconnect, device number 1 [ 48.377824][ T59] vhci_hcd: stop threads [ 48.377840][ T4495] vhci_hcd vhci_hcd.0: USB bus 3 deregistered [ 48.378619][ T59] vhci_hcd: release socket [ 48.380523][ T59] vhci_hcd: disconnect device [ 48.381570][ T59] vhci_hcd: stop threads [ 48.382176][ T4495] vhci_hcd vhci_hcd.0: remove, state 4 [ 48.382269][ T59] ================================================================== [ 48.383270][ T4495] usb usb2: USB disconnect, device number 1 [ 48.384546][ T59] BUG: KASAN: use-after-free in vhci_shutdown_connection+0x210/0x574 [ 48.384569][ T59] Read of size 8 at addr ffff0000d1f84758 by task kworker/u4:3/59 [ 48.384577][ T59] [ 48.384581][ T59] CPU: 1 PID: 59 Comm: kworker/u4:3 Not tainted syzkaller #0 [ 48.384587][ T59] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 48.384592][ T59] Workqueue: usbip_event event_handler [ 48.384605][ T59] Call trace: [ 48.384607][ T59] dump_backtrace+0x1c4/0x1f0 [ 48.384614][ T59] show_stack+0x2c/0x3c [ 48.384618][ T59] __dump_stack+0x30/0x40 [ 48.384625][ T59] dump_stack_lvl+0xf4/0x15c [ 48.384631][ T59] print_address_description+0x88/0x218 [ 48.384638][ T59] print_report+0x50/0x68 [ 48.397411][ T59] kasan_report+0xa8/0xfc [ 48.398147][ T59] __asan_report_load8_noabort+0x2c/0x38 [ 48.399146][ T59] vhci_shutdown_connection+0x210/0x574 [ 48.400050][ T59] event_handler+0x288/0x454 [ 48.400816][ T59] process_one_work+0x7e4/0x13bc [ 48.401612][ T59] worker_thread+0x8cc/0xfe8 [ 48.402381][ T59] kthread+0x254/0x2e0 [ 48.403051][ T59] ret_from_fork+0x10/0x20 [ 48.403791][ T59] [ 48.404165][ T59] Allocated by task 1: [ 48.404803][ T59] kasan_set_track+0x4c/0x80 [ 48.405514][ T59] kasan_save_alloc_info+0x24/0x30 [ 48.406376][ T59] __kasan_kmalloc+0xa0/0xb8 [ 48.407104][ T59] __kmalloc+0xd8/0x180 [ 48.407732][ T59] __usb_create_hcd+0x6c/0x740 [ 48.408479][ T59] usb_create_shared_hcd+0x40/0x54 [ 48.409013][ T4495] vhci_hcd vhci_hcd.0: USB bus 2 deregistered [ 48.409265][ T59] vhci_hcd_probe+0x1a4/0x354 [ 48.410975][ T59] platform_probe+0x148/0x1c8 [ 48.411708][ T59] really_probe+0x3a0/0xac4 [ 48.412484][ T59] __driver_probe_device+0x1c8/0x368 [ 48.413426][ T59] driver_probe_device+0x78/0x324 [ 48.414261][ T59] __device_attach_driver+0x28c/0x4c0 [ 48.415129][ T59] bus_for_each_drv+0x154/0x1e4 [ 48.415982][ T59] __device_attach+0x2a4/0x3d8 [ 48.416757][ T59] device_initial_probe+0x24/0x34 [ 48.417583][ T59] bus_probe_device+0xbc/0x1c4 [ 48.418369][ T59] device_add+0x93c/0xe4c [ 48.419064][ T59] platform_device_add+0x3f8/0x6f4 [ 48.419919][ T59] vhci_hcd_init+0x390/0x4b0 [ 48.420659][ T59] do_one_initcall+0x278/0x9f0 [ 48.421543][ T59] do_initcall_level+0x158/0x214 [ 48.422366][ T59] do_initcalls+0x58/0xac [ 48.423109][ T59] do_basic_setup+0x8c/0xa0 [ 48.423853][ T59] kernel_init_freeable+0x35c/0x4f0 [ 48.424734][ T59] kernel_init+0x24/0x1d8 [ 48.425468][ T59] ret_from_fork+0x10/0x20 [ 48.426194][ T59] [ 48.426613][ T59] Freed by task 4495: [ 48.427248][ T59] kasan_set_track+0x4c/0x80 [ 48.428020][ T59] kasan_save_free_info+0x38/0x5c [ 48.428880][ T59] ____kasan_slab_free+0x148/0x1b0 [ 48.429754][ T59] __kasan_slab_free+0x18/0x28 [ 48.430525][ T59] slab_free_freelist_hook+0x16c/0x1e8 [ 48.431406][ T59] __kmem_cache_free+0xbc/0x21c [ 48.432302][ T59] kfree+0xd0/0x1a8 [ 48.432914][ T59] usb_put_hcd+0x124/0x16c [ 48.433591][ T59] vhci_hcd_remove+0x98/0x100 [ 48.434312][ T59] platform_remove+0x98/0xf0 [ 48.435085][ T59] device_release_driver_internal+0x3d4/0x6e4 [ 48.436129][ T59] device_driver_detach+0x48/0x58 [ 48.436907][ T59] unbind_store+0x2a8/0x2b4 [ 48.437663][ T59] drv_attr_store+0x80/0xa4 [ 48.438382][ T59] sysfs_kf_write+0x1f8/0x274 [ 48.439080][ T59] kernfs_fop_write_iter+0x390/0x4b4 [ 48.439961][ T59] vfs_write+0x3c8/0x7c8 [ 48.440645][ T59] ksys_write+0x12c/0x228 [ 48.441380][ T59] __arm64_sys_write+0x7c/0x90 [ 48.442187][ T59] invoke_syscall+0x98/0x290 [ 48.442941][ T59] el0_svc_common+0x13c/0x258 [ 48.443742][ T59] do_el0_svc+0x5c/0x134 [ 48.444427][ T59] el0_svc+0x58/0x128 [ 48.445184][ T59] el0t_64_sync_handler+0x84/0xf0 [ 48.446092][ T59] el0t_64_sync+0x18c/0x190 [ 48.446881][ T59] [ 48.447295][ T59] The buggy address belongs to the object at ffff0000d1f84000 [ 48.447295][ T59] which belongs to the cache kmalloc-8k of size 8192 [ 48.449754][ T59] The buggy address is located 1880 bytes inside of [ 48.449754][ T59] 8192-byte region [ffff0000d1f84000, ffff0000d1f86000) [ 48.451873][ T59] [ 48.452236][ T59] The buggy address belongs to the physical page: [ 48.453296][ T59] page:0000000026407423 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111f80 [ 48.454964][ T59] head:0000000026407423 order:3 compound_mapcount:0 compound_pincount:0 [ 48.456363][ T59] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 48.457639][ T59] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002c00 [ 48.459109][ T59] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 48.460564][ T59] page dumped because: kasan: bad access detected [ 48.461609][ T59] [ 48.461994][ T59] Memory state around the buggy address: [ 48.462919][ T59] ffff0000d1f84600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.464219][ T59] ffff0000d1f84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.465590][ T59] >ffff0000d1f84700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.466962][ T59] ^ [ 48.468158][ T59] ffff0000d1f84780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.469523][ T59] ffff0000d1f84800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.470863][ T59] ================================================================== [ 48.495772][ T59] Disabling lock debugging due to kernel taint [ 48.496918][ T59] vhci_hcd: release socket [ 48.497659][ T59] vhci_hcd: disconnect device [ 48.498449][ T59] vhci_hcd: stop threads [ 48.499139][ T59] vhci_hcd: release socket [ 48.499853][ T59] vhci_hcd: disconnect device [ 48.500676][ T59] vhci_hcd: stop threads [ 48.501366][ T59] vhci_hcd: release socket [ 48.502116][ T59] vhci_hcd: disconnect device [ 48.502875][ T59] vhci_hcd: stop threads [ 48.503548][ T59] vhci_hcd: release socket [ 48.506338][ T59] vhci_hcd: disconnect device [ 48.507116][ T59] vhci_hcd: stop threads [ 48.507844][ T59] vhci_hcd: release socket [ 48.508556][ T59] vhci_hcd: disconnect device [ 48.509309][ T59] vhci_hcd: stop threads [ 48.509986][ T59] vhci_hcd: release socket [ 48.510764][ T59] vhci_hcd: disconnect device [ 48.511585][ T59] vhci_hcd: stop threads [ 48.512263][ T59] vhci_hcd: release socket [ 48.512996][ T59] vhci_hcd: disconnect device [ 48.513752][ T59] vhci_hcd: stop threads [ 48.515589][ T59] vhci_hcd: release socket [ 48.516337][ T59] vhci_hcd: disconnect device [ 48.517110][ T59] vhci_hcd: stop threads [ 48.517788][ T59] vhci_hcd: release socket [ 48.518525][ T59] vhci_hcd: disconnect device [ 48.519253][ T59] vhci_hcd: stop threads [ 48.519911][ T59] vhci_hcd: release socket [ 48.520565][ T59] vhci_hcd: disconnect device [ 48.521331][ T59] vhci_hcd: stop threads [ 48.522012][ T59] vhci_hcd: release socket [ 48.522736][ T59] vhci_hcd: disconnect device [ 48.523473][ T59] vhci_hcd: stop threads [ 48.524432][ T59] vhci_hcd: release socket [ 48.525117][ T59] vhci_hcd: disconnect device [ 48.525911][ T59] vhci_hcd: stop threads [ 48.526612][ T59] vhci_hcd: release socket [ 48.527321][ T59] vhci_hcd: disconnect device [ 48.528100][ T59] vhci_hcd: stop threads [ 48.528795][ T59] vhci_hcd: release socket [ 48.529500][ T59] vhci_hcd: disconnect device [ 48.530226][ T59] vhci_hcd: stop threads [ 48.530888][ T59] vhci_hcd: release socket [ 48.531610][ T59] vhci_hcd: disconnect device