Warning: Permanently added '10.128.0.6' (ED25519) to the list of known hosts.
executing program
executing program
[  539.612781][ T7328] printk: legacy console [ttyGS0] disabled
[  539.654652][ T7330] printk: legacy console [ttyGS0] disabled
executing program
[  539.863469][ T7332] printk: legacy console [ttyGS0] disabled
executing program
[  540.074722][ T7334] printk: legacy console [ttyGS0] disabled
[  540.147400][ T7333] ==================================================================
[  540.147496][ T7333] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x40
** replaying previous printk message **
[  540.147496][ T7333] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400
[  540.147695][ T7333] Read of size 1 at addr ffff88802b714488 by task syz-executor158/7333
[  540.147712][ T7333] 
[  540.147764][ T7333] CPU: 1 UID: 0 PID: 7333 Comm: syz-executor158 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  540.147820][ T7333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  540.147842][ T7333] Call Trace:
[  540.147882][ T7333]  <TASK>
[  540.147918][ T7333]  dump_stack_lvl+0xe8/0x150
[  540.148040][ T7333]  print_address_description+0x55/0x1e0
[  540.148073][ T7333]  ? rt_spin_lock+0x83/0x400
[  540.148103][ T7333]  print_report+0x58/0x70
[  540.148131][ T7333]  kasan_report+0x117/0x150
[  540.148189][ T7333]  ? rt_spin_lock+0x83/0x400
[  540.148216][ T7333]  __kasan_check_byte+0x2a/0x40
[  540.148251][ T7333]  lock_acquire+0x7d/0x350
[  540.148297][ T7333]  ? do_raw_spin_lock+0x12b/0x2f0
[  540.148319][ T7333]  rt_spin_lock+0x83/0x400
[  540.148342][ T7333]  ? gs_close+0xb9/0xbb0
[  540.148393][ T7333]  ? __pfx_rt_spin_lock+0x10/0x10
[  540.148418][ T7333]  ? rt_mutex_slowunlock+0x4ee/0xa30
[  540.148445][ T7333]  gs_close+0xb9/0xbb0
[  540.148469][ T7333]  ? __pfx_gs_close+0x10/0x10
[  540.148488][ T7333]  ? rt_spin_unlock+0x159/0x200
[  540.148514][ T7333]  ? rt_spin_unlock+0x165/0x200
[  540.148539][ T7333]  ? fasync_remove_entry+0x1a4/0x1d0
[  540.148599][ T7333]  ? __pfx_gs_close+0x10/0x10
[  540.148623][ T7333]  tty_release+0x35f/0x1680
[  540.148678][ T7333]  ? evm_file_release+0x10a/0x1e0
[  540.148716][ T7333]  ? __pfx_tty_release+0x10/0x10
[  540.148734][ T7333]  __fput+0x42a/0xa80
[  540.148769][ T7333]  fput_close_sync+0x11f/0x240
[  540.148787][ T7333]  ? __pfx_fput_close_sync+0x10/0x10
[  540.148811][ T7333]  __x64_sys_close+0x7e/0x110
[  540.148828][ T7333]  do_syscall_64+0x166/0x520
[  540.148888][ T7333]  ? trace_irq_disable+0x3b/0x140
[  540.148934][ T7333]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  540.148973][ T7333]  ? clear_bhb_loop+0x70/0xc0
[  540.148996][ T7333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  540.149020][ T7333] RIP: 0033:0x7fccd3f6ec0e
[  540.149075][ T7333] Code: 08 0f 85 65 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  540.149094][ T7333] RSP: 002b:00007ffed8338a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[  540.149181][ T7333] RAX: ffffffffffffffda RBX: 000055556cea1400 RCX: 00007fccd3f6ec0e
[  540.149197][ T7333] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
[  540.149208][ T7333] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[  540.149219][ T7333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000083a90
[  540.149230][ T7333] R13: 0000000000083ac2 R14: 00007fccd400bb2c R15: 00007fccd400bb20
[  540.149264][ T7333]  </TASK>
[  540.149271][ T7333] 
[  540.149280][ T7333] Allocated by task 7334:
[  540.149328][ T7333]  kasan_save_track+0x3e/0x80
[  540.149355][ T7333]  __kasan_kmalloc+0x93/0xb0
[  540.149377][ T7333]  __kmalloc_cache_noprof+0x3d5/0x680
[  540.149411][ T7333]  gserial_alloc_line_no_console+0x23a/0x700
[  540.149428][ T7333]  gserial_alloc_line+0x18/0x90
[  540.149442][ T7333]  acm_alloc_instance+0xc7/0x140
[  540.149462][ T7333]  usb_get_function_instance+0xe3/0x2f0
[  540.149495][ T7333]  function_make+0x127/0x360
[  540.149515][ T7333]  configfs_mkdir+0x4f6/0x9e0
[  540.149559][ T7333]  vfs_mkdir+0x408/0x620
[  540.149583][ T7333]  filename_mkdirat+0x289/0x520
[  540.149604][ T7333]  __se_sys_mkdirat+0x35/0x150
[  540.149627][ T7333]  do_syscall_64+0x166/0x520
[  540.149643][ T7333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  540.149661][ T7333] 
[  540.149665][ T7333] Freed by task 7334:
[  540.149675][ T7333]  kasan_save_track+0x3e/0x80
[  540.149698][ T7333]  kasan_save_free_info+0x40/0x50
[  540.149726][ T7333]  __kasan_slab_free+0x5c/0x80
[  540.149751][ T7333]  kfree+0x1c5/0x6d0
[  540.149772][ T7333]  gserial_free_port+0x240/0x2c0
[  540.149789][ T7333]  gserial_free_line+0xc3/0x1f0
[  540.149803][ T7333]  acm_free_instance+0x39/0x60
[  540.149822][ T7333]  usb_put_function_instance+0x95/0xc0
[  540.149839][ T7333]  config_item_release+0x13a/0x2d0
[  540.149854][ T7333]  configfs_rmdir+0x885/0x950
[  540.149877][ T7333]  vfs_rmdir+0x3e9/0x6b0
[  540.149902][ T7333]  filename_rmdir+0x292/0x520
[  540.149928][ T7333]  __se_sys_rmdir+0x2e/0x140
[  540.149961][ T7333]  do_syscall_64+0x166/0x520
[  540.149977][ T7333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  540.149996][ T7333] 
[  540.150001][ T7333] The buggy address belongs to the object at ffff88802b714000
[  540.150001][ T7333]  which belongs to the cache kmalloc-2k of size 2048
[  540.150018][ T7333] The buggy address is located 1160 bytes inside of
[  540.150018][ T7333]  freed 2048-byte region [ffff88802b714000, ffff88802b714800)
[  540.150039][ T7333] 
[  540.150044][ T7333] The buggy address belongs to the physical page:
[  540.150068][ T7333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b710
[  540.150086][ T7333] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  540.150103][ T7333] flags: 0x80000000000040(head|node=0|zone=1)
[  540.150129][ T7333] page_type: f5(slab)
[  540.150149][ T7333] raw: 0080000000000040 ffff88813ff00000 dead000000000100 dead000000000122
[  540.150166][ T7333] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[  540.150186][ T7333] head: 0080000000000040 ffff88813ff00000 dead000000000100 dead000000000122
[  540.150201][ T7333] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[  540.150221][ T7333] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  540.150238][ T7333] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[  540.150396][ T7333] page dumped because: kasan: bad access detected
[  540.150419][ T7333] page_owner tracks the page as allocated
[  540.150428][ T7333] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22801572255
[  540.150462][ T7333]  post_alloc_hook+0x1f9/0x250
[  540.150491][ T7333]  get_page_from_freelist+0x2591/0x2600
[  540.150521][ T7333]  __alloc_frozen_pages_noprof+0x230/0x5c0
[  540.150551][ T7333]  allocate_slab+0x7d/0x620
[  540.150572][ T7333]  refill_objects+0x2d8/0x350
[  540.150593][ T7333]  __pcs_replace_empty_main+0x339/0x690
[  540.150613][ T7333]  __kmalloc_cache_noprof+0x46f/0x680
[  540.150640][ T7333]  usb_hub_create_port_device+0x7d/0xc40
[  540.150715][ T7333]  hub_probe+0x26d6/0x3c20
[  540.150755][ T7333]  usb_probe_interface+0x788/0xe50
[  540.150775][ T7333]  really_probe+0x254/0xae0
[  540.150834][ T7333]  __driver_probe_device+0x1e8/0x360
[  540.150864][ T7333]  driver_probe_device+0x4f/0x240
[  540.150894][ T7333]  __device_attach_driver+0x270/0x410
[  540.150925][ T7333]  bus_for_each_drv+0x25b/0x2f0
[  540.150949][ T7333]  __device_attach+0x2c7/0x450
[  540.150977][ T7333] page_owner free stack trace missing
[  540.150986][ T7333] 
[  540.150991][ T7333] Memory state around the buggy address:
[  540.151003][ T7333]  ffff88802b714380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  540.151023][ T7333]  ffff88802b714400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  540.151091][ T7333] >ffff88802b714480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  540.151119][ T7333]                       ^
[  540.151131][ T7333]  ffff88802b714500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  540.151142][ T7333]  ffff88802b714580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  540.151151][ T7333] ==================================================================
[  540.171060][ T7333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  540.942950][ T7333] CPU: 1 UID: 0 PID: 7333 Comm: syz-executor158 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  540.954129][ T7333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  540.964943][ T7333] Call Trace:
[  540.968434][ T7333]  <TASK>
[  540.971505][ T7333]  vpanic+0x56d/0xa60
[  540.975594][ T7333]  ? __pfx_vpanic+0x10/0x10
[  540.980227][ T7333]  ? __pfx___schedule+0x10/0x10
[  540.985676][ T7333]  panic+0xc5/0xd0
[  540.989538][ T7333]  ? __pfx_panic+0x10/0x10
[  540.993995][ T7333]  ? preempt_schedule_thunk+0x16/0x40
[  540.999512][ T7333]  ? rt_spin_lock+0x83/0x400
[  541.004344][ T7333]  check_panic_on_warn+0x89/0xb0
[  541.009743][ T7333]  ? rt_spin_lock+0x83/0x400
[  541.014649][ T7333]  end_report+0x73/0x170
[  541.019159][ T7333]  ? rt_spin_lock+0x83/0x400
[  541.024055][ T7333]  kasan_report+0x128/0x150
[  541.028735][ T7333]  ? rt_spin_lock+0x83/0x400
[  541.033712][ T7333]  __kasan_check_byte+0x2a/0x40
[  541.038931][ T7333]  lock_acquire+0x7d/0x350
[  541.043407][ T7333]  ? do_raw_spin_lock+0x12b/0x2f0
[  541.048566][ T7333]  rt_spin_lock+0x83/0x400
[  541.053149][ T7333]  ? gs_close+0xb9/0xbb0
[  541.057437][ T7333]  ? __pfx_rt_spin_lock+0x10/0x10
[  541.062961][ T7333]  ? rt_mutex_slowunlock+0x4ee/0xa30
[  541.068881][ T7333]  gs_close+0xb9/0xbb0
[  541.073003][ T7333]  ? __pfx_gs_close+0x10/0x10
[  541.077899][ T7333]  ? rt_spin_unlock+0x159/0x200
[  541.082796][ T7333]  ? rt_spin_unlock+0x165/0x200
[  541.088123][ T7333]  ? fasync_remove_entry+0x1a4/0x1d0
[  541.093453][ T7333]  ? __pfx_gs_close+0x10/0x10
[  541.098269][ T7333]  tty_release+0x35f/0x1680
[  541.102985][ T7333]  ? evm_file_release+0x10a/0x1e0
[  541.108159][ T7333]  ? __pfx_tty_release+0x10/0x10
[  541.113303][ T7333]  __fput+0x42a/0xa80
[  541.117443][ T7333]  fput_close_sync+0x11f/0x240
[  541.122248][ T7333]  ? __pfx_fput_close_sync+0x10/0x10
[  541.127780][ T7333]  __x64_sys_close+0x7e/0x110
[  541.132600][ T7333]  do_syscall_64+0x166/0x520
[  541.137424][ T7333]  ? trace_irq_disable+0x3b/0x140
[  541.142919][ T7333]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  541.149115][ T7333]  ? clear_bhb_loop+0x70/0xc0
[  541.154195][ T7333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  541.160477][ T7333] RIP: 0033:0x7fccd3f6ec0e
[  541.165136][ T7333] Code: 08 0f 85 65 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  541.185400][ T7333] RSP: 002b:00007ffed8338a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[  541.194478][ T7333] RAX: ffffffffffffffda RBX: 000055556cea1400 RCX: 00007fccd3f6ec0e
[  541.202849][ T7333] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
[  541.211211][ T7333] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[  541.220282][ T7333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000083a90
[  541.228389][ T7333] R13: 0000000000083ac2 R14: 00007fccd400bb2c R15: 00007fccd400bb20
[  541.236952][ T7333]  </TASK>
[  541.240976][ T7333] Kernel Offset: disabled
[  541.245783][ T7333] Rebooting in 86400 seconds..