Warning: Permanently added '10.128.1.190' (ED25519) to the list of known hosts.
2026/09/27 14:56:15 parsed 1 programs
2026/09/27 14:56:15 serving rpc on tcp://42339
Setting up swapspace version 1, size = 127995904 bytes
[ 110.962969][ T5949] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 114.357350][ T6028] bridge0: port 1(bridge_slave_0) entered blocking state
[ 114.357457][ T6028] bridge0: port 1(bridge_slave_0) entered disabled state
[ 114.357535][ T6028] bridge_slave_0: entered allmulticast mode
[ 114.358555][ T6028] bridge_slave_0: entered promiscuous mode
[ 114.361242][ T6028] bridge0: port 2(bridge_slave_1) entered blocking state
[ 114.361342][ T6028] bridge0: port 2(bridge_slave_1) entered disabled state
[ 114.361466][ T6028] bridge_slave_1: entered allmulticast mode
[ 114.363245][ T6028] bridge_slave_1: entered promiscuous mode
[ 114.398618][ T6028] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 114.402040][ T6028] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 114.431964][ T6028] team0: Port device team_slave_0 added
[ 114.434031][ T6028] team0: Port device team_slave_1 added
[ 114.456717][ T6028] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 114.456734][ T6028] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 114.456752][ T6028] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 114.460261][ T6028] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 114.460276][ T6028] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 114.460296][ T6028] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 114.506831][ T6028] hsr_slave_0: entered promiscuous mode
[ 114.508158][ T6028] hsr_slave_1: entered promiscuous mode
[ 115.032033][ T6028] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 115.036162][ T6028] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 115.053358][ T6028] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 115.067791][ T6028] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 115.068967][ T6028] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 115.073010][ T6028] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 115.074140][ T6028] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 115.107503][ T6028] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 115.139891][ T6028] bridge0: port 2(bridge_slave_1) entered blocking state
[ 115.140008][ T6028] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 115.140996][ T6028] bridge0: port 1(bridge_slave_0) entered blocking state
[ 115.141122][ T6028] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 115.233684][ T6028] 8021q: adding VLAN 0 to HW filter on device bond0
[ 115.253604][ T299] bridge0: port 1(bridge_slave_0) entered disabled state
[ 115.254231][ T299] bridge0: port 2(bridge_slave_1) entered disabled state
[ 115.276525][ T6028] 8021q: adding VLAN 0 to HW filter on device team0
[ 115.286632][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state
[ 115.286749][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 115.294000][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state
[ 115.294097][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 115.784167][ T6028] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 115.847965][ T6028] veth0_vlan: entered promiscuous mode
[ 115.855463][ T6028] veth1_vlan: entered promiscuous mode
[ 115.894032][ T6028] veth0_macvtap: entered promiscuous mode
[ 115.902927][ T6028] veth1_macvtap: entered promiscuous mode
[ 115.923129][ T6028] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 115.934181][ T6028] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 115.968572][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 115.968902][ T50] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 115.969226][ T50] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 115.969265][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 116.218243][ T1166] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 116.313822][ T1166] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 116.432388][ T1166] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 116.552452][ T1166] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 118.632796][ T1166] bridge_slave_1: left allmulticast mode
[ 118.632821][ T1166] bridge_slave_1: left promiscuous mode
[ 118.633023][ T1166] bridge0: port 2(bridge_slave_1) entered disabled state
[ 118.636382][ T1166] bridge_slave_0: left allmulticast mode
[ 118.636406][ T1166] bridge_slave_0: left promiscuous mode
[ 118.636594][ T1166] bridge0: port 1(bridge_slave_0) entered disabled state
[ 118.844249][ T1166] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 118.846717][ T1166] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 118.878293][ T1166] bond0 (unregistering): Released all slaves
[ 118.982396][ T1166] hsr_slave_0: left promiscuous mode
[ 118.993223][ T1166] hsr_slave_1: left promiscuous mode
[ 118.994187][ T1166] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 118.994206][ T1166] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 118.995930][ T1166] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 118.995947][ T1166] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 119.040541][ T1166] veth1_macvtap: left promiscuous mode
[ 119.040589][ T1166] veth0_macvtap: left promiscuous mode
[ 119.040700][ T1166] veth1_vlan: left promiscuous mode
[ 119.040737][ T1166] veth0_vlan: left promiscuous mode
[ 119.326011][ T1166] team0 (unregistering): Port device team_slave_1 removed
[ 119.347632][ T1166] team0 (unregistering): Port device team_slave_0 removed
[ 120.653967][ T5743] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 120.655885][ T5743] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 120.658345][ T5743] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 120.659161][ T5743] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 120.659722][ T5743] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 121.178533][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 121.178554][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 121.266249][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 121.266270][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/09/27 14:56:31 executed programs: 0
[ 122.142269][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 122.143799][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 122.144343][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 122.145516][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 122.146051][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 122.849113][ T5280] 8021q: adding VLAN 0 to HW filter on device eth1
[ 122.849488][ T6293] bridge0: port 1(bridge_slave_0) entered blocking state
[ 122.849637][ T6293] bridge0: port 1(bridge_slave_0) entered disabled state
[ 122.850660][ T6293] bridge_slave_0: entered allmulticast mode
[ 122.852125][ T6293] bridge_slave_0: entered promiscuous mode
[ 122.854740][ T6293] bridge0: port 2(bridge_slave_1) entered blocking state
[ 122.854900][ T6293] bridge0: port 2(bridge_slave_1) entered disabled state
[ 122.855281][ T6293] bridge_slave_1: entered allmulticast mode
[ 122.857263][ T6293] bridge_slave_1: entered promiscuous mode
[ 122.891095][ T6293] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 122.902036][ T6293] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 122.945100][ T6293] team0: Port device team_slave_0 added
[ 122.954255][ T6293] team0: Port device team_slave_1 added
[ 122.990010][ T6293] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 122.990027][ T6293] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 122.990044][ T6293] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 122.991889][ T6293] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 122.991902][ T6293] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 122.991923][ T6293] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 123.138711][ T6293] hsr_slave_0: entered promiscuous mode
[ 123.139753][ T6293] hsr_slave_1: entered promiscuous mode
[ 123.628609][ T6293] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 123.632624][ T6293] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 123.633611][ T6293] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 123.667536][ T6293] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 123.668447][ T6293] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 123.674231][ T6293] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 123.675332][ T6293] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 123.707777][ T6293] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 123.808829][ T6293] 8021q: adding VLAN 0 to HW filter on device bond0
[ 123.842992][ T6293] 8021q: adding VLAN 0 to HW filter on device team0
[ 123.851563][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state
[ 123.851662][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 123.860591][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state
[ 123.860705][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 124.229418][ T52] Bluetooth: hci0: command tx timeout
[ 124.335526][ T6293] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 124.391662][ T6293] veth0_vlan: entered promiscuous mode
[ 124.398661][ T6293] veth1_vlan: entered promiscuous mode
[ 124.427712][ T6293] veth0_macvtap: entered promiscuous mode
[ 124.430642][ T6293] veth1_macvtap: entered promiscuous mode
[ 124.443218][ T6293] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 124.454027][ T6293] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 124.521563][ T299] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 124.521585][ T299] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 124.527999][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.528352][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.528384][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.528412][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.568941][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 124.568960][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 124.869983][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 125.017149][ T9] usb 1-1: Using ep0 maxpacket: 32
[ 125.019937][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short
[ 125.020031][ T9] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 125.022327][ T9] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 125.022341][ T9] usb 1-1: config 3 has an invalid interface number: 25 but max is 1
[ 125.022350][ T9] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 125.022358][ T9] usb 1-1: config 3 has no interface number 0
[ 125.022365][ T9] usb 1-1: config 3 has no interface number 1
[ 125.022412][ T9] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 125.022421][ T9] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 125.022433][ T9] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 125.022450][ T9] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 125.022463][ T9] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 125.022474][ T9] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 125.022486][ T9] usb 1-1: config 3 interface 223 has no altsetting 1
[ 125.022494][ T9] usb 1-1: config 3 interface 25 has no altsetting 0
[ 125.024585][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 125.024597][ T9] usb 1-1: Product: syz
[ 125.024604][ T9] usb 1-1: Manufacturer: syz
[ 125.024610][ T9] usb 1-1: SerialNumber: syz
[ 125.411651][ T9] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 125.429976][ T9] usb 1-1: USB disconnect, device number 2
[ 125.455400][ T9]
[ 125.457746][ T9] =========================
[ 125.462239][ T9] WARNING: held lock freed!
[ 125.466750][ T9] syzkaller #0 Not tainted
[ 125.471150][ T9] -------------------------
[ 125.475639][ T9] kworker/0:0/9 is freeing memory ffff88807f0fd000-ffff88807f0fd7ff, with a lock still held there!
[ 125.486288][ T9] ffff88807f0fd1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 125.496381][ T9] locks held by kworker/0:0/9: 5, last CPU#0:
[ 125.502447][ T9] #0: ffff888022ef9540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 125.513760][ T9] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 125.525583][ T9] #2: ffff8880298611d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 125.534442][ T9] #3: ffff88807f9121d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 125.543588][ T9] #4: ffff88807f0fd1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 125.554206][ T9]
[ 125.554206][ T9] stack backtrace:
[ 125.560105][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 125.569208][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 125.579256][ T9] Workqueue: usb_hub_wq hub_event
[ 125.584301][ T9] Call Trace:
[ 125.587583][ T9]
[ 125.590523][ T9] dump_stack_lvl+0xe8/0x150
[ 125.595129][ T9] debug_check_no_locks_freed+0x149/0x170
[ 125.600851][ T9] kfree+0x12b/0x650
[ 125.604750][ T9] ? device_release+0xc4/0x1f0
[ 125.609517][ T9] ? __pfx_usb_release_interface+0x10/0x10
[ 125.615359][ T9] device_release+0xc4/0x1f0
[ 125.619946][ T9] kobject_put+0x222/0x550
[ 125.624367][ T9] v4l2_device_disconnect+0x79/0xd0
[ 125.629563][ T9] usbtv_disconnect+0x5c/0xa0
[ 125.634231][ T9] usb_unbind_interface+0x295/0x9f0
[ 125.639436][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 125.645152][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 125.650863][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 125.656574][ T9] device_release_driver_internal+0x4f5/0x880
[ 125.662653][ T9] bus_remove_device+0x444/0x560
[ 125.667680][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 125.673162][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 125.678891][ T9] device_del+0x524/0x8f0
[ 125.683212][ T9] ? __pfx_device_del+0x10/0x10
[ 125.688049][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 125.693078][ T9] usb_disable_device+0x3d4/0x8d0
[ 125.698105][ T9] usb_disconnect+0x346/0x9a0
[ 125.702784][ T9] hub_event+0x1bbb/0x4d30
[ 125.707199][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 125.712313][ T9] ? register_lock_class+0x31/0x2e0
[ 125.717514][ T9] ? __pfx_hub_event+0x10/0x10
[ 125.722270][ T9] ? rcu_is_watching+0x16/0xb0
[ 125.727048][ T9] ? process_scheduled_works+0x97a/0x1630
[ 125.732758][ T9] process_scheduled_works+0xc3d/0x1630
[ 125.738307][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 125.744287][ T9] ? assign_work+0x3cf/0x5d0
[ 125.748879][ T9] worker_thread+0xa47/0xfb0
[ 125.753494][ T9] kthread+0x38b/0x480
[ 125.757586][ T9] ? __pfx_worker_thread+0x10/0x10
[ 125.762696][ T9] ? __pfx_kthread+0x10/0x10
[ 125.767288][ T9] ret_from_fork+0x514/0xb70
[ 125.771870][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 125.776978][ T9] ? __switch_to+0xc89/0x1420
[ 125.781664][ T9] ? __pfx_kthread+0x10/0x10
[ 125.786249][ T9] ret_from_fork_asm+0x1a/0x30
[ 125.791022][ T9]
[ 125.799083][ T9] ==================================================================
[ 125.799096][ T9] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 125.799122][ T9] Read of size 8 at addr ffff88807f0fd008 by task kworker/0:0/9
[ 125.799135][ T9]
[ 125.799143][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 125.799160][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 125.799172][ T9] Workqueue: usb_hub_wq hub_event
[ 125.799194][ T9] Call Trace:
[ 125.799201][ T9]
[ 125.799208][ T9] dump_stack_lvl+0xe8/0x150
[ 125.799233][ T9] print_address_description+0x55/0x1e0
[ 125.799256][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 125.799276][ T9] print_report+0x58/0x70
[ 125.799296][ T9] kasan_report+0x117/0x150
[ 125.799317][ T9] ? kobject_put+0x50f/0x550
[ 125.799343][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 125.799368][ T9] usb_unbind_interface+0x2c2/0x9f0
[ 125.799390][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 125.799413][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 125.799432][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 125.799453][ T9] device_release_driver_internal+0x4f5/0x880
[ 125.799486][ T9] bus_remove_device+0x444/0x560
[ 125.799513][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 125.799538][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 125.799558][ T9] device_del+0x524/0x8f0
[ 125.799581][ T9] ? __pfx_device_del+0x10/0x10
[ 125.799598][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 125.799623][ T9] usb_disable_device+0x3d4/0x8d0
[ 125.799646][ T9] usb_disconnect+0x346/0x9a0
[ 125.799666][ T9] hub_event+0x1bbb/0x4d30
[ 125.799685][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 125.799713][ T9] ? register_lock_class+0x31/0x2e0
[ 125.799741][ T9] ? __pfx_hub_event+0x10/0x10
[ 125.799764][ T9] ? rcu_is_watching+0x16/0xb0
[ 125.799784][ T9] ? process_scheduled_works+0x97a/0x1630
[ 125.799807][ T9] process_scheduled_works+0xc3d/0x1630
[ 125.799839][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 125.799863][ T9] ? assign_work+0x3cf/0x5d0
[ 125.799885][ T9] worker_thread+0xa47/0xfb0
[ 125.799916][ T9] kthread+0x38b/0x480
[ 125.799932][ T9] ? __pfx_worker_thread+0x10/0x10
[ 125.799953][ T9] ? __pfx_kthread+0x10/0x10
[ 125.799969][ T9] ret_from_fork+0x514/0xb70
[ 125.799986][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 125.800001][ T9] ? __switch_to+0xc89/0x1420
[ 125.800023][ T9] ? __pfx_kthread+0x10/0x10
[ 125.800039][ T9] ret_from_fork_asm+0x1a/0x30
[ 125.800068][ T9]
[ 125.800074][ T9]
[ 125.800078][ T9] Allocated by task 9:
[ 125.800086][ T9] kasan_save_track+0x3e/0x80
[ 125.800102][ T9] __kasan_kmalloc+0x93/0xb0
[ 125.800118][ T9] __kmalloc_cache_noprof+0x321/0x600
[ 125.800133][ T9] usb_set_configuration+0x3cc/0x2180
[ 125.800151][ T9] usb_generic_driver_probe+0x8d/0x150
[ 125.800170][ T9] usb_probe_device+0x1c3/0x3b0
[ 125.800187][ T9] really_probe+0x254/0xae0
[ 125.800203][ T9] __driver_probe_device+0x1e8/0x360
[ 125.800217][ T9] driver_probe_device+0x4f/0x240
[ 125.800234][ T9] __device_attach_driver+0x270/0x410
[ 125.800252][ T9] bus_for_each_drv+0x258/0x2f0
[ 125.800274][ T9] __device_attach+0x2c4/0x450
[ 125.800290][ T9] device_initial_probe+0xa1/0xd0
[ 125.800307][ T9] bus_probe_device+0x12a/0x220
[ 125.800328][ T9] device_add+0x7d7/0xb80
[ 125.800342][ T9] usb_new_device+0x9aa/0x1690
[ 125.800357][ T9] hub_event+0x28e8/0x4d30
[ 125.800374][ T9] process_scheduled_works+0xc3d/0x1630
[ 125.800393][ T9] worker_thread+0xa47/0xfb0
[ 125.800413][ T9] kthread+0x38b/0x480
[ 125.800427][ T9] ret_from_fork+0x514/0xb70
[ 125.800441][ T9] ret_from_fork_asm+0x1a/0x30
[ 125.800464][ T9]
[ 125.800468][ T9] Freed by task 9:
[ 125.800484][ T9] kasan_save_track+0x3e/0x80
[ 125.800500][ T9] kasan_save_free_info+0x40/0x50
[ 125.800522][ T9] __kasan_slab_free+0x5c/0x80
[ 125.800538][ T9] kfree+0x1c5/0x650
[ 125.800558][ T9] device_release+0xc4/0x1f0
[ 125.800577][ T9] kobject_put+0x222/0x550
[ 125.800599][ T9] v4l2_device_disconnect+0x79/0xd0
[ 125.800620][ T9] usbtv_disconnect+0x5c/0xa0
[ 125.800640][ T9] usb_unbind_interface+0x295/0x9f0
[ 125.800659][ T9] device_release_driver_internal+0x4f5/0x880
[ 125.800678][ T9] bus_remove_device+0x444/0x560
[ 125.800699][ T9] device_del+0x524/0x8f0
[ 125.800713][ T9] usb_disable_device+0x3d4/0x8d0
[ 125.800730][ T9] usb_disconnect+0x346/0x9a0
[ 125.800745][ T9] hub_event+0x1bbb/0x4d30
[ 125.800761][ T9] process_scheduled_works+0xc3d/0x1630
[ 125.800780][ T9] worker_thread+0xa47/0xfb0
[ 125.800800][ T9] kthread+0x38b/0x480
[ 125.800813][ T9] ret_from_fork+0x514/0xb70
[ 125.800826][ T9] ret_from_fork_asm+0x1a/0x30
[ 125.800848][ T9]
[ 125.800852][ T9] The buggy address belongs to the object at ffff88807f0fd000
[ 125.800852][ T9] which belongs to the cache kmalloc-2k of size 2048
[ 125.800866][ T9] The buggy address is located 8 bytes inside of
[ 125.800866][ T9] freed 2048-byte region [ffff88807f0fd000, ffff88807f0fd800)
[ 125.800883][ T9]
[ 125.800887][ T9] The buggy address belongs to the physical page:
[ 125.800903][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f0f8
[ 125.800919][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 125.800932][ T9] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 125.800956][ T9] page_type: f5(slab)
[ 125.800970][ T9] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 125.800984][ T9] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 125.800999][ T9] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 125.801012][ T9] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 125.801026][ T9] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 125.801040][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 125.801048][ T9] page dumped because: kasan: bad access detected
[ 125.801063][ T9] page_owner tracks the page as allocated
[ 125.801069][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5737, tgid 5737 (syz-executor), ts 85486599226
[ 125.801095][ T9] post_alloc_hook+0x1f9/0x250
[ 125.801117][ T9] get_page_from_freelist+0x2209/0x2280
[ 125.801134][ T9] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 125.801150][ T9] allocate_slab+0x7d/0x620
[ 125.801169][ T9] refill_objects+0x2d5/0x350
[ 125.801188][ T9] __pcs_replace_empty_main+0x2c8/0x6c0
[ 125.801206][ T9] __kmalloc_node_track_caller_noprof+0x548/0x720
[ 125.801223][ T9] __alloc_skb+0x2c1/0x7a0
[ 125.801241][ T9] rtmsg_ifinfo_build_skb+0x7f/0x260
[ 125.801257][ T9] rtmsg_ifinfo+0x8c/0x1a0
[ 125.801271][ T9] register_netdevice+0x1a9a/0x1eb0
[ 125.801294][ T9] __ip_tunnel_create+0x3e8/0x550
[ 125.801308][ T9] ip_tunnel_init_net+0x2e5/0x820
[ 125.801323][ T9] vti_init_net+0x2f/0x100
[ 125.801340][ T9] ops_init+0x35d/0x5d0
[ 125.801357][ T9] setup_net+0x118/0x350
[ 125.801373][ T9] page last free pid 5626 tgid 5626 ts 79292303247 stack trace:
[ 125.801384][ T9] __free_frozen_pages+0xc93/0xd90
[ 125.801407][ T9] __folio_put+0x4b3/0x590
[ 125.801437][ T9] skb_release_data+0x573/0xab0
[ 125.801458][ T9] __kfree_skb+0x5d/0x210
[ 125.801484][ T9] tcp_ack+0x28f7/0x8050
[ 125.801500][ T9] tcp_rcv_established+0x154f/0x2940
[ 125.801517][ T9] tcp_v4_do_rcv+0x727/0x13b0
[ 125.801538][ T9] __release_sock+0x25b/0x390
[ 125.801561][ T9] __sk_flush_backlog+0x36/0xc0
[ 125.801584][ T9] tcp_sendmsg_locked+0x4173/0x5400
[ 125.801602][ T9] tcp_sendmsg+0x2f/0x50
[ 125.801618][ T9] sock_sendmsg_nosec+0x10e/0x180
[ 125.801632][ T9] sock_write_iter+0x2de/0x3e0
[ 125.801645][ T9] vfs_write+0x612/0xba0
[ 125.801667][ T9] ksys_write+0x150/0x270
[ 125.801688][ T9] do_syscall_64+0x166/0x520
[ 125.801708][ T9]
[ 125.801712][ T9] Memory state around the buggy address:
[ 125.801720][ T9] ffff88807f0fcf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 125.801731][ T9] ffff88807f0fcf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 125.801741][ T9] >ffff88807f0fd000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 125.801749][ T9] ^
[ 125.801758][ T9] ffff88807f0fd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 125.801767][ T9] ffff88807f0fd100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 125.801776][ T9] ==================================================================
[ 125.801862][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 126.645202][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 126.654308][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 126.664364][ T9] Workqueue: usb_hub_wq hub_event
[ 126.669405][ T9] Call Trace:
[ 126.672688][ T9]
[ 126.675615][ T9] vpanic+0x56d/0xa60
[ 126.679603][ T9] ? rcu_is_watching+0x16/0xb0
[ 126.684452][ T9] ? __pfx_vpanic+0x10/0x10
[ 126.688956][ T9] ? __pfx___schedule+0x10/0x10
[ 126.693831][ T9] panic+0xc5/0xd0
[ 126.697548][ T9] ? __pfx_panic+0x10/0x10
[ 126.701967][ T9] ? preempt_schedule_thunk+0x16/0x40
[ 126.707330][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 126.712692][ T9] check_panic_on_warn+0x89/0xb0
[ 126.717621][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 126.722991][ T9] end_report+0x73/0x170
[ 126.727227][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 126.732588][ T9] kasan_report+0x128/0x150
[ 126.737083][ T9] ? kobject_put+0x50f/0x550
[ 126.741667][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 126.747031][ T9] usb_unbind_interface+0x2c2/0x9f0
[ 126.752220][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 126.757931][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 126.763643][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 126.769357][ T9] device_release_driver_internal+0x4f5/0x880
[ 126.775415][ T9] bus_remove_device+0x444/0x560
[ 126.780358][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 126.785826][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 126.791560][ T9] device_del+0x524/0x8f0
[ 126.795902][ T9] ? __pfx_device_del+0x10/0x10
[ 126.800757][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 126.805784][ T9] usb_disable_device+0x3d4/0x8d0
[ 126.810806][ T9] usb_disconnect+0x346/0x9a0
[ 126.815478][ T9] hub_event+0x1bbb/0x4d30
[ 126.820412][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 126.825525][ T9] ? register_lock_class+0x31/0x2e0
[ 126.830729][ T9] ? __pfx_hub_event+0x10/0x10
[ 126.835490][ T9] ? rcu_is_watching+0x16/0xb0
[ 126.840259][ T9] ? process_scheduled_works+0x97a/0x1630
[ 126.845973][ T9] process_scheduled_works+0xc3d/0x1630
[ 126.851522][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 126.857512][ T9] ? assign_work+0x3cf/0x5d0
[ 126.862113][ T9] worker_thread+0xa47/0xfb0
[ 126.866721][ T9] kthread+0x38b/0x480
[ 126.870781][ T9] ? __pfx_worker_thread+0x10/0x10
[ 126.875886][ T9] ? __pfx_kthread+0x10/0x10
[ 126.880467][ T9] ret_from_fork+0x514/0xb70
[ 126.885063][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 126.890169][ T9] ? __switch_to+0xc89/0x1420
[ 126.894850][ T9] ? __pfx_kthread+0x10/0x10
[ 126.899432][ T9] ret_from_fork_asm+0x1a/0x30
[ 126.904296][ T9]
[ 126.907566][ T9] Kernel Offset: disabled
[ 126.911880][ T9] Rebooting in 86400 seconds..