Warning: Permanently added '10.128.1.161' (ED25519) to the list of known hosts.
[*] Setting up signal handler...
[+] sigaction successful.
[*] Binding raw-gadget to dummy_udc...
[+] raw-gadget bound to UDC 'dummy_udc.2', raw_fd = 3.
[*] Starting EP0 handler thread...
[+] EP0 handler thread started.
[*] Waiting for sur40 to probe and register in /sys/class/video4linux/...
[ 101.017249][ T5757] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 101.168571][ T5757] usb 3-1: New USB device found: idVendor=045e, idProduct=0775, bcdDevice=1.00
[ 101.171527][ T5757] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 102.240918][ T5757] input: Samsung SUR40 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input5
[ 102.279432][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[ 102.306870][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[ 102.331464][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[ 102.349670][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[ 102.402925][ T5997] sur40 3-1:1.0: error in usb_bulk_read
[ 102.416580][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[ 102.441937][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[ 102.448746][ T4984] sur40 3-1:1.0: error in usb_bulk_read
[+] Found sur40 device: v4l-touch24 (major: 81, minor: 255, iface: 3-1:1.0)
[+] Created character device node: /dev/v4l-touch24_sur40
[*] Opening /dev/v4l-touch24_sur40...
[+] Successfully opened /dev/v4l-touch24_sur40, vfd = 4.
[*] Unbinding interface '3-1:1.0' from sur40 driver...
[+] Wrote '3-1:1.0' to /sys/bus/usb/drivers/sur40/unbind.
[*] Stopping EP0 loop thread and closing /dev/raw-gadget...
[+] /dev/raw-gadget closed successfully.
[*] Waiting for /sys/class/video4linux/v4l-touch24 to be unregistered...
[+] Device v4l-touch24 unregistered successfully!
[ 102.881104][ T5705] usb 3-1: USB disconnect, device number 2
[*] Closing vfd (4) to trigger UAF in vb2_core_queue_release()...
[ 102.978700][ T5968] ==================================================================
[ 102.978721][ T5968] BUG: KASAN: slab-use-after-free in v4l2_release+0xb5/0x350
[ 102.978749][ T5968] Read of size 8 at addr ffff888027306658 by task syz-executor151/5968
[ 102.978764][ T5968]
[ 102.978781][ T5968] CPU: 1 UID: 0 PID: 5968 Comm: syz-executor151 Not tainted syzkaller #0 PREEMPT(full)
[ 102.978800][ T5968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[ 102.978817][ T5968] Call Trace:
[ 102.978824][ T5968]
[ 102.978832][ T5968] dump_stack_lvl+0xe8/0x150
[ 102.978859][ T5968] print_address_description+0x55/0x1e0
[ 102.978892][ T5968] ? v4l2_release+0xb5/0x350
[ 102.978910][ T5968] print_report+0x58/0x70
[ 102.978932][ T5968] kasan_report+0x117/0x150
[ 102.978955][ T5968] ? __pfx___fsnotify_parent+0x10/0x10
[ 102.978980][ T5968] ? v4l2_release+0xb5/0x350
[ 102.979003][ T5968] v4l2_release+0xb5/0x350
[ 102.979023][ T5968] ? __pfx_v4l2_release+0x10/0x10
[ 102.979041][ T5968] __fput+0x408/0xa40
[ 102.979063][ T5968] fput_close_sync+0x11f/0x240
[ 102.979080][ T5968] ? __pfx_fput_close_sync+0x10/0x10
[ 102.979098][ T5968] ? do_raw_spin_unlock+0xf5/0x200
[ 102.979119][ T5968] __se_sys_close+0xa2/0x160
[ 102.979138][ T5968] do_int80_emulation+0x198/0x500
[ 102.979158][ T5968] ? trace_irq_disable+0x3b/0x140
[ 102.979180][ T5968] ? asm_int80_emulation+0x1a/0x20
[ 102.979196][ T5968] ? clear_bhb_loop+0x70/0xc0
[ 102.979213][ T5968] ? clear_bhb_loop+0x70/0xc0
[ 102.979232][ T5968] asm_int80_emulation+0x1a/0x20
[ 102.979248][ T5968] RIP: 0023:0xf7ef68db
[ 102.979267][ T5968] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 d7 e8 ff ff 66 90 66 90 66 90 90 55
[ 102.979282][ T5968] RSP: 002b:00000000ffee1e5c EFLAGS: 00000246 ORIG_RAX: 0000000000000006
[ 102.979304][ T5968] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000
[ 102.979315][ T5968] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 102.979324][ T5968] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 102.979334][ T5968] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[ 102.979345][ T5968] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 102.979361][ T5968]
[ 102.979366][ T5968]
[ 102.979370][ T5968] Allocated by task 5757:
[ 102.979377][ T5968] kasan_save_track+0x3e/0x80
[ 102.979396][ T5968] __kasan_kmalloc+0x93/0xb0
[ 102.979415][ T5968] __kmalloc_cache_noprof+0x31c/0x600
[ 102.979434][ T5968] sur40_probe+0x16c/0xfa0
[ 102.979449][ T5968] usb_probe_interface+0x751/0xe00
[ 102.979465][ T5968] really_probe+0x254/0xae0
[ 102.979481][ T5968] __driver_probe_device+0x1e8/0x360
[ 102.979496][ T5968] driver_probe_device+0x4f/0x240
[ 102.979512][ T5968] __device_attach_driver+0x270/0x410
[ 102.979528][ T5968] bus_for_each_drv+0x258/0x2f0
[ 102.979547][ T5968] __device_attach+0x2bd/0x430
[ 102.979561][ T5968] device_initial_probe+0x9c/0x100
[ 102.979576][ T5968] __bus_probe_device+0x126/0x220
[ 102.979594][ T5968] device_add+0x7d7/0xb80
[ 102.979615][ T5968] usb_set_configuration+0x1bb5/0x2260
[ 102.979639][ T5968] usb_generic_driver_probe+0x8d/0x150
[ 102.979661][ T5968] usb_probe_device+0x1c3/0x3b0
[ 102.979675][ T5968] really_probe+0x254/0xae0
[ 102.979687][ T5968] __driver_probe_device+0x1e8/0x360
[ 102.979702][ T5968] driver_probe_device+0x4f/0x240
[ 102.979717][ T5968] __device_attach_driver+0x270/0x410
[ 102.979733][ T5968] bus_for_each_drv+0x258/0x2f0
[ 102.979752][ T5968] __device_attach+0x2bd/0x430
[ 102.979765][ T5968] device_initial_probe+0x9c/0x100
[ 102.979780][ T5968] __bus_probe_device+0x126/0x220
[ 102.979799][ T5968] device_add+0x7d7/0xb80
[ 102.979819][ T5968] usb_new_device+0x9aa/0x1690
[ 102.979837][ T5968] hub_event+0x28e8/0x4d30
[ 102.979859][ T5968] process_scheduled_works+0xc3d/0x1630
[ 102.979888][ T5968] worker_thread+0xa47/0xfb0
[ 102.979909][ T5968] kthread+0x38b/0x480
[ 102.979925][ T5968] ret_from_fork+0x514/0xb70
[ 102.979942][ T5968] ret_from_fork_asm+0x1a/0x30
[ 102.979957][ T5968]
[ 102.979961][ T5968] Freed by task 5968:
[ 102.979968][ T5968] kasan_save_track+0x3e/0x80
[ 102.979987][ T5968] kasan_save_free_info+0x40/0x50
[ 102.980003][ T5968] __kasan_slab_free+0x5c/0x80
[ 102.980022][ T5968] kfree+0x1c5/0x650
[ 102.980036][ T5968] sur40_disconnect+0xaf/0x140
[ 102.980051][ T5968] usb_unbind_interface+0x295/0x9c0
[ 102.980064][ T5968] device_release_driver_internal+0x48d/0x7d0
[ 102.980081][ T5968] unbind_store+0x1a1/0x1d0
[ 102.980101][ T5968] kernfs_fop_write_iter+0x3a4/0x540
[ 102.980119][ T5968] vfs_write+0x612/0xba0
[ 102.980140][ T5968] ksys_write+0x150/0x270
[ 102.980158][ T5968] do_int80_emulation+0x198/0x500
[ 102.980175][ T5968] asm_int80_emulation+0x1a/0x20
[ 102.980190][ T5968]
[ 102.980194][ T5968] The buggy address belongs to the object at ffff888027306000
[ 102.980194][ T5968] which belongs to the cache kmalloc-4k of size 4096
[ 102.980209][ T5968] The buggy address is located 1624 bytes inside of
[ 102.980209][ T5968] freed 4096-byte region [ffff888027306000, ffff888027307000)
[ 102.980226][ T5968]
[ 102.980231][ T5968] The buggy address belongs to the physical page:
[ 102.980245][ T5968] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27300
[ 102.980261][ T5968] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 102.980274][ T5968] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 102.980290][ T5968] page_type: f5(slab)
[ 102.980305][ T5968] raw: 00fff00000000040 ffff88813ff29140 dead000000000100 dead000000000122
[ 102.980320][ T5968] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 102.980335][ T5968] head: 00fff00000000040 ffff88813ff29140 dead000000000100 dead000000000122
[ 102.980349][ T5968] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 102.980363][ T5968] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 102.980377][ T5968] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 102.980385][ T5968] page dumped because: kasan: bad access detected
[ 102.980397][ T5968] page_owner tracks the page as allocated
[ 102.980403][ T5968] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5706504568
[ 102.980435][ T5968] post_alloc_hook+0x1f9/0x250
[ 102.980451][ T5968] get_page_from_freelist+0x220f/0x2280
[ 102.980471][ T5968] __alloc_frozen_pages_noprof+0x1fe/0x410
[ 102.980490][ T5968] allocate_slab+0x7d/0x5e0
[ 102.980503][ T5968] refill_objects+0x2d5/0x350
[ 102.980517][ T5968] __pcs_replace_empty_main+0x2c8/0x6c0
[ 102.980539][ T5968] __kmalloc_cache_noprof+0x396/0x600
[ 102.980557][ T5968] kobject_uevent_env+0x289/0x9e0
[ 102.980580][ T5968] driver_register+0x2d4/0x320
[ 102.980596][ T5968] panel_edp_init+0x1d/0x60
[ 102.980616][ T5968] do_one_initcall+0x250/0x870
[ 102.980630][ T5968] do_initcall_level+0x10a/0x1a0
[ 102.980650][ T5968] do_initcalls+0x59/0xa0
[ 102.980668][ T5968] kernel_init_freeable+0x29d/0x3e0
[ 102.980686][ T5968] kernel_init+0x22/0x1d0
[ 102.980705][ T5968] ret_from_fork+0x514/0xb70
[ 102.980721][ T5968] page_owner free stack trace missing
[ 102.980727][ T5968]
[ 102.980731][ T5968] Memory state around the buggy address:
[ 102.980740][ T5968] ffff888027306500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.980751][ T5968] ffff888027306580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.980762][ T5968] >ffff888027306600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.980770][ T5968] ^
[ 102.980779][ T5968] ffff888027306680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.980790][ T5968] ffff888027306700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.980798][ T5968] ==================================================================
[ 102.981231][ T5968] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.753555][ T5968] CPU: 1 UID: 0 PID: 5968 Comm: syz-executor151 Not tainted syzkaller #0 PREEMPT(full)
[ 103.763353][ T5968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[ 103.773411][ T5968] Call Trace:
[ 103.776706][ T5968]
[ 103.779638][ T5968] vpanic+0x26f/0x710
[ 103.783640][ T5968] panic+0xc5/0xd0
[ 103.787354][ T5968] ? __pfx_panic+0x10/0x10
[ 103.791757][ T5968] ? preempt_schedule_thunk+0x16/0x40
[ 103.797120][ T5968] ? preempt_schedule_thunk+0x16/0x40
[ 103.802503][ T5968] ? v4l2_release+0xb5/0x350
[ 103.807082][ T5968] check_panic_on_warn+0x89/0xb0
[ 103.812011][ T5968] ? v4l2_release+0xb5/0x350
[ 103.816591][ T5968] end_report+0x73/0x170
[ 103.820934][ T5968] ? v4l2_release+0xb5/0x350
[ 103.825739][ T5968] kasan_report+0x128/0x150
[ 103.830668][ T5968] ? __pfx___fsnotify_parent+0x10/0x10
[ 103.836216][ T5968] ? v4l2_release+0xb5/0x350
[ 103.840997][ T5968] v4l2_release+0xb5/0x350
[ 103.845410][ T5968] ? __pfx_v4l2_release+0x10/0x10
[ 103.850638][ T5968] __fput+0x408/0xa40
[ 103.854617][ T5968] fput_close_sync+0x11f/0x240
[ 103.859457][ T5968] ? __pfx_fput_close_sync+0x10/0x10
[ 103.864733][ T5968] ? do_raw_spin_unlock+0xf5/0x200
[ 103.870108][ T5968] __se_sys_close+0xa2/0x160
[ 103.874816][ T5968] do_int80_emulation+0x198/0x500
[ 103.879857][ T5968] ? trace_irq_disable+0x3b/0x140
[ 103.884893][ T5968] ? asm_int80_emulation+0x1a/0x20
[ 103.890083][ T5968] ? clear_bhb_loop+0x70/0xc0
[ 103.894772][ T5968] ? clear_bhb_loop+0x70/0xc0
[ 103.899463][ T5968] asm_int80_emulation+0x1a/0x20
[ 103.904419][ T5968] RIP: 0023:0xf7ef68db
[ 103.908477][ T5968] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 d7 e8 ff ff 66 90 66 90 66 90 90 55
[ 103.928260][ T5968] RSP: 002b:00000000ffee1e5c EFLAGS: 00000246 ORIG_RAX: 0000000000000006
[ 103.936669][ T5968] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000
[ 103.944887][ T5968] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 103.952855][ T5968] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 103.960832][ T5968] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[ 103.968802][ T5968] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 103.976911][ T5968]
[ 103.980288][ T5968] Kernel Offset: disabled
[ 103.984625][ T5968] Rebooting in 86400 seconds..