[ 133.116451][ T1330] ieee802154 phy0 wpan0: encryption failed: -22
[ 133.116512][ T1330] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '10.128.1.47' (ED25519) to the list of known hosts.
2026/09/15 05:44:41 parsed 1 programs
2026/09/15 05:44:41 serving rpc on tcp://38711
Setting up swapspace version 1, size = 127995904 bytes
[ 145.261008][ T6123] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 149.182729][ T5760] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 149.184722][ T5760] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 149.205564][ T5760] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 149.209262][ T5760] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 149.210152][ T5760] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 152.075631][ T6182] bridge0: port 1(bridge_slave_0) entered blocking state
[ 152.075775][ T6182] bridge0: port 1(bridge_slave_0) entered disabled state
[ 152.075869][ T6182] bridge_slave_0: entered allmulticast mode
[ 152.077414][ T6182] bridge_slave_0: entered promiscuous mode
[ 152.079421][ T6182] bridge0: port 2(bridge_slave_1) entered blocking state
[ 152.079557][ T6182] bridge0: port 2(bridge_slave_1) entered disabled state
[ 152.079658][ T6182] bridge_slave_1: entered allmulticast mode
[ 152.081270][ T6182] bridge_slave_1: entered promiscuous mode
[ 152.246555][ T6182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 152.250166][ T6182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 152.288996][ T6182] team0: Port device team_slave_0 added
[ 152.291162][ T6182] team0: Port device team_slave_1 added
[ 152.329435][ T6182] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 152.329454][ T6182] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 152.329469][ T6182] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 152.330931][ T6182] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 152.330944][ T6182] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 152.330959][ T6182] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 152.399416][ T6182] hsr_slave_0: entered promiscuous mode
[ 152.400621][ T6182] hsr_slave_1: entered promiscuous mode
[ 154.716742][ T6182] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 154.748371][ T6182] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 154.750799][ T6182] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 154.808834][ T6182] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 154.810537][ T6182] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 154.852604][ T6182] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 154.858822][ T6182] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 154.896000][ T6182] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 155.065823][ T6182] 8021q: adding VLAN 0 to HW filter on device bond0
[ 155.104279][ T6182] 8021q: adding VLAN 0 to HW filter on device team0
[ 155.116039][ T2960] bridge0: port 1(bridge_slave_0) entered blocking state
[ 155.116244][ T2960] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 155.136566][ T2960] bridge0: port 2(bridge_slave_1) entered blocking state
[ 155.136812][ T2960] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 155.920323][ T6182] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 156.045049][ T6182] veth0_vlan: entered promiscuous mode
[ 156.060382][ T6182] veth1_vlan: entered promiscuous mode
[ 156.116127][ T6182] veth0_macvtap: entered promiscuous mode
[ 156.123674][ T6182] veth1_macvtap: entered promiscuous mode
[ 156.162918][ T6182] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 156.178807][ T6182] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 156.451978][ T2957] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.495498][ T2957] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.496864][ T2957] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.496911][ T2957] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 157.090897][ T2960] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 158.020001][ T2960] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 158.859826][ T2960] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 159.319948][ T2960] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 160.362340][ T2960] bridge_slave_1: left allmulticast mode
[ 160.362381][ T2960] bridge_slave_1: left promiscuous mode
[ 160.365541][ T2960] bridge0: port 2(bridge_slave_1) entered disabled state
[ 160.512740][ T2960] bridge_slave_0: left allmulticast mode
[ 160.512772][ T2960] bridge_slave_0: left promiscuous mode
[ 160.512970][ T2960] bridge0: port 1(bridge_slave_0) entered disabled state
[ 161.262158][ T2960] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 161.322148][ T2960] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 161.363682][ T2960] bond0 (unregistering): Released all slaves
[ 161.649648][ T2942] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 161.649672][ T2942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 161.801563][ T2960] hsr_slave_0: left promiscuous mode
[ 161.841553][ T2960] hsr_slave_1: left promiscuous mode
[ 161.843064][ T2960] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 161.843092][ T2960] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 161.892680][ T2960] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 161.892711][ T2960] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 161.984594][ T2960] veth1_macvtap: left promiscuous mode
[ 161.984716][ T2960] veth0_macvtap: left promiscuous mode
[ 161.991254][ T2960] veth1_vlan: left promiscuous mode
[ 161.993446][ T2960] veth0_vlan: left promiscuous mode
[ 162.672086][ T2960] team0 (unregistering): Port device team_slave_1 removed
[ 162.712086][ T2960] team0 (unregistering): Port device team_slave_0 removed
[ 162.895756][ T5298] 8021q: adding VLAN 0 to HW filter on device eth1
[ 162.909472][ T2965] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 162.909494][ T2965] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 163.771097][ T5298] 8021q: adding VLAN 0 to HW filter on device eth2
2026/09/15 05:45:06 executed programs: 0
[ 165.200048][ T5760] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 165.227281][ T5760] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 165.234665][ T5760] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 165.240896][ T5760] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 165.244829][ T5760] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 165.445112][ T5298] 8021q: adding VLAN 0 to HW filter on device eth3
[ 166.390249][ T5298] 8021q: adding VLAN 0 to HW filter on device eth4
[ 166.457491][ T6469] bridge0: port 1(bridge_slave_0) entered blocking state
[ 166.457768][ T6469] bridge0: port 1(bridge_slave_0) entered disabled state
[ 166.457949][ T6469] bridge_slave_0: entered allmulticast mode
[ 166.460925][ T6469] bridge_slave_0: entered promiscuous mode
[ 166.471214][ T6469] bridge0: port 2(bridge_slave_1) entered blocking state
[ 166.471902][ T6469] bridge0: port 2(bridge_slave_1) entered disabled state
[ 166.472074][ T6469] bridge_slave_1: entered allmulticast mode
[ 166.476674][ T6469] bridge_slave_1: entered promiscuous mode
[ 166.529471][ T6469] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 166.538491][ T6469] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 166.609424][ T6469] team0: Port device team_slave_0 added
[ 166.613913][ T6469] team0: Port device team_slave_1 added
[ 166.673994][ T6469] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 166.674014][ T6469] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 166.674041][ T6469] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 166.676775][ T6469] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 166.676789][ T6469] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 166.676817][ T6469] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 166.849558][ T6469] hsr_slave_0: entered promiscuous mode
[ 166.850959][ T6469] hsr_slave_1: entered promiscuous mode
[ 167.341641][ T60] Bluetooth: hci0: command tx timeout
[ 169.421537][ T60] Bluetooth: hci0: command tx timeout
[ 170.128072][ T6469] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 170.187695][ T6469] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 170.189657][ T6469] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 170.234526][ T6469] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 170.238326][ T6469] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 170.272752][ T6469] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 170.275151][ T6469] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 170.330570][ T6469] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 170.550278][ T6469] 8021q: adding VLAN 0 to HW filter on device bond0
[ 170.599900][ T6469] 8021q: adding VLAN 0 to HW filter on device team0
[ 170.623272][ T2961] bridge0: port 1(bridge_slave_0) entered blocking state
[ 170.642644][ T2961] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 170.673915][ T2942] bridge0: port 2(bridge_slave_1) entered blocking state
[ 170.674098][ T2942] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 171.439138][ T6469] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 171.503398][ T60] Bluetooth: hci0: command tx timeout
[ 171.570194][ T6469] veth0_vlan: entered promiscuous mode
[ 171.592574][ T6469] veth1_vlan: entered promiscuous mode
[ 171.671320][ T6469] veth0_macvtap: entered promiscuous mode
[ 171.695431][ T6469] veth1_macvtap: entered promiscuous mode
[ 171.731094][ T6469] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 171.769780][ T6469] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 171.895580][ T2947] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 171.895633][ T2947] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 171.895672][ T2947] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 171.895708][ T2947] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 172.154033][ T2960] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 172.154059][ T2960] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 172.210343][ T2960] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 172.210368][ T2960] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/09/15 05:45:13 executed programs: 2
[ 172.372685][ T6628] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000
[ 172.373546][ T6628] udc dummy_udc.0: failed to start g1: -19
[ 172.376563][ T6628] UDC core: g1: couldn't find an available UDC or it's busy
[ 172.448638][ T6630] ==================================================================
[ 172.448654][ T6630] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190
[ 172.448679][ T6630] Read of size 8 at addr ffff888035891390 by task syz.0.18/6630
[ 172.448696][ T6630]
[ 172.448708][ T6630] CPU: 1 UID: 0 PID: 6630 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 172.448732][ T6630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026
[ 172.448744][ T6630] Call Trace:
[ 172.448752][ T6630]
[ 172.448761][
** replaying previous printk message **
[ 172.448761][ T6630] dump_stack_lvl+0xe8/0x150
[ 172.448792][ T6630] print_address_description+0x55/0x1e0
[ 172.448831][ T6630] ? filp_flush+0x31/0x190
[ 172.448848][ T6630] print_report+0x58/0x70
[ 172.448874][ T6630] kasan_report+0x117/0x150
[ 172.448903][ T6630] ? filp_flush+0x31/0x190
[ 172.448925][ T6630] kasan_check_range+0x264/0x2c0
[ 172.448953][ T6630] filp_flush+0x31/0x190
[ 172.448972][ T6630] filp_close+0x1d/0x40
[ 172.448989][ T6630] gaudio_cleanup+0x54/0xf0
[ 172.449011][ T6630] f_audio_bind+0x4a0/0x630
[ 172.449033][ T6630] ? __pfx_f_audio_bind+0x10/0x10
[ 172.449054][ T6630] ? rcu_is_watching+0x16/0xb0
[ 172.449082][ T6630] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 172.449105][ T6630] usb_add_function+0x290/0x930
[ 172.449134][ T6630] ? check_remote_wakeup_config+0x58/0x1c0
[ 172.449164][ T6630] configfs_composite_bind+0xde0/0x1410
[ 172.449199][ T6630] ? __pfx_configfs_composite_bind+0x10/0x10
[ 172.449227][ T6630] gadget_bind_driver+0x2ca/0x9e0
[ 172.449257][ T6630] ? __pfx_gadget_bind_driver+0x10/0x10
[ 172.449281][ T6630] really_probe+0x254/0xae0
[ 172.449302][ T6630] __driver_probe_device+0x1e8/0x360
[ 172.449330][ T6630] driver_probe_device+0x4f/0x240
[ 172.449350][ T6630] __driver_attach+0x339/0x600
[ 172.449380][ T6630] bus_for_each_dev+0x23e/0x2c0
[ 172.449408][ T6630] ? __pfx___driver_attach+0x10/0x10
[ 172.449435][ T6630] ? __pfx_bus_for_each_dev+0x10/0x10
[ 172.449459][ T6630] ? rt_spin_unlock+0x165/0x200
[ 172.449482][ T6630] bus_add_driver+0x348/0x670
[ 172.449508][ T6630] driver_register+0x23a/0x320
[ 172.449530][ T6630] usb_gadget_register_driver_owner+0xf9/0x270
[ 172.449556][ T6630] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 172.449581][ T6630] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 172.449608][ T6630] configfs_write_iter+0x33a/0x430
[ 172.449636][ T6630] vfs_write+0x61e/0xbb0
[ 172.449660][ T6630] ? __pfx_vfs_write+0x10/0x10
[ 172.449680][ T6630] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 172.449710][ T6630] ? mutex_lock_nested+0x152/0x1d0
[ 172.449730][ T6630] ? fdget_pos+0x252/0x320
[ 172.449754][ T6630] ksys_write+0x156/0x270
[ 172.449778][ T6630] ? __pfx_ksys_write+0x10/0x10
[ 172.449805][ T6630] do_syscall_64+0x166/0x520
[ 172.449839][ T6630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.449860][ T6630] ? clear_bhb_loop+0x70/0xc0
[ 172.449881][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.449900][ T6630] RIP: 0033:0x7f0acb14e0d9
[ 172.449919][ T6630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 172.449937][ T6630] RSP: 002b:00007f0aca7ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 172.449960][ T6630] RAX: ffffffffffffffda RBX: 00007f0acb3d5fa0 RCX: 00007f0acb14e0d9
[ 172.449976][ T6630] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 172.449990][ T6630] RBP: 00007f0acb1e5024 R08: 0000000000000000 R09: 0000000000000000
[ 172.450003][ T6630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 172.450016][ T6630] R13: 00007f0acb3d6038 R14: 00007f0acb3d5fa0 R15: 00007ffda21c5708
[ 172.450038][ T6630]
[ 172.450046][ T6630]
[ 172.450051][ T6630] Allocated by task 6628:
[ 172.450061][ T6630] kasan_save_track+0x3e/0x80
[ 172.450087][ T6630] __kasan_slab_alloc+0x6c/0x80
[ 172.450112][ T6630] kmem_cache_alloc_noprof+0x360/0x690
[ 172.450136][ T6630] alloc_empty_file+0x5b/0x1d0
[ 172.450162][ T6630] path_openat+0xa2/0x1d60
[ 172.450183][ T6630] do_file_open+0x23e/0x4a0
[ 172.450205][ T6630] filp_open+0x16d/0x1d0
[ 172.450231][ T6630] gaudio_setup+0x11b/0xf10
[ 172.450250][ T6630] f_audio_bind+0x137/0x630
[ 172.450268][ T6630] usb_add_function+0x290/0x930
[ 172.450294][ T6630] configfs_composite_bind+0xde0/0x1410
[ 172.450322][ T6630] gadget_bind_driver+0x2ca/0x9e0
[ 172.450344][ T6630] really_probe+0x254/0xae0
[ 172.450361][ T6630] __driver_probe_device+0x1e8/0x360
[ 172.450388][ T6630] driver_probe_device+0x4f/0x240
[ 172.450404][ T6630] __driver_attach+0x339/0x600
[ 172.450430][ T6630] bus_for_each_dev+0x23e/0x2c0
[ 172.450451][ T6630] bus_add_driver+0x348/0x670
[ 172.450470][ T6630] driver_register+0x23a/0x320
[ 172.450488][ T6630] usb_gadget_register_driver_owner+0xf9/0x270
[ 172.450509][ T6630] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 172.450532][ T6630] configfs_write_iter+0x33a/0x430
[ 172.450554][ T6630] vfs_write+0x61e/0xbb0
[ 172.450572][ T6630] ksys_write+0x156/0x270
[ 172.450591][ T6630] do_syscall_64+0x166/0x520
[ 172.450615][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.450633][ T6630]
[ 172.450637][ T6630] Freed by task 28:
[ 172.450646][ T6630] kasan_save_track+0x3e/0x80
[ 172.450668][ T6630] kasan_save_free_info+0x40/0x50
[ 172.450689][ T6630] __kasan_slab_free+0x5c/0x80
[ 172.450712][ T6630] slab_free_after_rcu_debug+0x12a/0x220
[ 172.450731][ T6630] rcu_cpu_kthread+0xb2c/0x1740
[ 172.450753][ T6630] smpboot_thread_fn+0x565/0xa70
[ 172.450779][ T6630] kthread+0x38b/0x470
[ 172.450795][ T6630] ret_from_fork+0x514/0xb70
[ 172.450811][ T6630] ret_from_fork_asm+0x1a/0x30
[ 172.450835][ T6630]
[ 172.450840][ T6630] Last potentially related work creation:
[ 172.450847][ T6630] kasan_save_stack+0x3e/0x60
[ 172.450871][ T6630] kasan_record_aux_stack+0xbd/0xd0
[ 172.450890][ T6630] kmem_cache_free+0x526/0x6d0
[ 172.450915][ T6630] task_work_run+0x1d9/0x270
[ 172.450934][ T6630] exit_to_user_mode_loop+0x204/0x770
[ 172.450957][ T6630] do_syscall_64+0x328/0x520
[ 172.450979][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.450997][ T6630]
[ 172.451002][ T6630] Second to last potentially related work creation:
[ 172.451010][ T6630] kasan_save_stack+0x3e/0x60
[ 172.451033][ T6630] kasan_record_aux_stack+0xbd/0xd0
[ 172.451053][ T6630] task_work_add+0xae/0x420
[ 172.451069][ T6630] __fput_deferred+0x183/0x3e0
[ 172.451095][ T6630] fput_close+0x11f/0x240
[ 172.451111][ T6630] filp_close+0x27/0x40
[ 172.451127][ T6630] gaudio_cleanup+0x54/0xf0
[ 172.451145][ T6630] f_audio_bind+0x4a0/0x630
[ 172.451163][ T6630] usb_add_function+0x290/0x930
[ 172.451189][ T6630] configfs_composite_bind+0xde0/0x1410
[ 172.451217][ T6630] gadget_bind_driver+0x2ca/0x9e0
[ 172.451238][ T6630] really_probe+0x254/0xae0
[ 172.451254][ T6630] __driver_probe_device+0x1e8/0x360
[ 172.451281][ T6630] driver_probe_device+0x4f/0x240
[ 172.451298][ T6630] __driver_attach+0x339/0x600
[ 172.451323][ T6630] bus_for_each_dev+0x23e/0x2c0
[ 172.451341][ T6630] bus_add_driver+0x348/0x670
[ 172.451360][ T6630] driver_register+0x23a/0x320
[ 172.451377][ T6630] usb_gadget_register_driver_owner+0xf9/0x270
[ 172.451398][ T6630] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 172.451420][ T6630] configfs_write_iter+0x33a/0x430
[ 172.451441][ T6630] vfs_write+0x61e/0xbb0
[ 172.451460][ T6630] ksys_write+0x156/0x270
[ 172.451478][ T6630] do_syscall_64+0x166/0x520
[ 172.451501][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.451518][ T6630]
[ 172.451523][ T6630] The buggy address belongs to the object at ffff888035891200
[ 172.451523][ T6630] which belongs to the cache filp of size 408
[ 172.451540][ T6630] The buggy address is located 400 bytes inside of
[ 172.451540][ T6630] freed 408-byte region [ffff888035891200, ffff888035891398)
[ 172.451560][ T6630]
[ 172.451565][ T6630] The buggy address belongs to the physical page:
[ 172.451575][ T6630] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35890
[ 172.451593][ T6630] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 172.451608][ T6630] memcg:ffff88801cfce001
[ 172.451617][ T6630] flags: 0x80000000000040(head|node=0|zone=1)
[ 172.451634][ T6630] page_type: f5(slab)
[ 172.451652][ T6630] raw: 0080000000000040 ffff88801b2ffc80 dead000000000100 dead000000000122
[ 172.451670][ T6630] raw: 0000000000000000 0000000200100010 00000000f5000000 ffff88801cfce001
[ 172.451688][ T6630] head: 0080000000000040 ffff88801b2ffc80 dead000000000100 dead000000000122
[ 172.451705][ T6630] head: 0000000000000000 0000000200100010 00000000f5000000 ffff88801cfce001
[ 172.451723][ T6630] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 172.451739][ T6630] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
[ 172.451749][ T6630] page dumped because: kasan: bad access detected
[ 172.451759][ T6630] page_owner tracks the page as allocated
[ 172.451767][ T6630] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5006, tgid 5006 (udevd), ts 32742063992
[ 172.451799][ T6630] post_alloc_hook+0x1f9/0x250
[ 172.451864][ T6630] get_page_from_freelist+0x2591/0x2600
[ 172.451892][ T6630] __alloc_frozen_pages_noprof+0x230/0x5c0
[ 172.451918][ T6630] allocate_slab+0x7d/0x620
[ 172.451936][ T6630] refill_objects+0x2d8/0x350
[ 172.451956][ T6630] __pcs_replace_empty_main+0x339/0x690
[ 172.451975][ T6630] kmem_cache_alloc_noprof+0x45d/0x690
[ 172.451997][ T6630] alloc_empty_file+0x5b/0x1d0
[ 172.452024][ T6630] path_openat+0xa2/0x1d60
[ 172.452045][ T6630] do_file_open+0x23e/0x4a0
[ 172.452066][ T6630] do_sys_openat2+0x115/0x200
[ 172.452092][ T6630] __x64_sys_openat+0x138/0x170
[ 172.452120][ T6630] do_syscall_64+0x166/0x520
[ 172.452145][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.452163][ T6630] page last free pid 5006 tgid 5006 ts 32708320783 stack trace:
[ 172.452178][ T6630] __free_frozen_pages+0xf8e/0x1070
[ 172.452201][ T6630] __slab_free+0x250/0x2a0
[ 172.452225][ T6630] qlist_free_all+0x99/0x100
[ 172.452247][ T6630] kasan_quarantine_reduce+0x148/0x160
[ 172.452271][ T6630] __kasan_slab_alloc+0x22/0x80
[ 172.452295][ T6630] kmem_cache_alloc_noprof+0x360/0x690
[ 172.452317][ T6630] do_getname+0x2e/0x250
[ 172.452342][ T6630] do_sys_openat2+0xcc/0x200
[ 172.452369][ T6630] __x64_sys_openat+0x138/0x170
[ 172.452395][ T6630] do_syscall_64+0x166/0x520
[ 172.452419][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.452438][ T6630]
[ 172.452443][ T6630] Memory state around the buggy address:
[ 172.452454][ T6630] ffff888035891280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 172.452467][ T6630] ffff888035891300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 172.452480][ T6630] >ffff888035891380: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 172.452489][ T6630] ^
[ 172.452500][ T6630] ffff888035891400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 172.452512][ T6630] ffff888035891480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 172.452522][ T6630] ==================================================================
[ 172.504898][ T6630] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 173.521892][ T6630] CPU: 0 UID: 0 PID: 6630 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 173.531536][ T6630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026
[ 173.541599][ T6630] Call Trace:
[ 173.544897][ T6630]
[ 173.547832][ T6630] vpanic+0x56d/0xa60
[ 173.551828][ T6630] ? rcu_is_watching+0x16/0xb0
[ 173.556611][ T6630] ? __pfx_vpanic+0x10/0x10
[ 173.561131][ T6630] panic+0xc5/0xd0
[ 173.564854][ T6630] ? __pfx_panic+0x10/0x10
[ 173.569280][ T6630] ? preempt_schedule_thunk+0x16/0x40
[ 173.574660][ T6630] ? filp_flush+0x31/0x190
[ 173.579080][ T6630] ? preempt_schedule_thunk+0x16/0x40
[ 173.584458][ T6630] ? filp_flush+0x31/0x190
[ 173.589232][ T6630] check_panic_on_warn+0x89/0xb0
[ 173.594185][ T6630] ? filp_flush+0x31/0x190
[ 173.598624][ T6630] end_report+0x73/0x170
[ 173.602896][ T6630] ? filp_flush+0x31/0x190
[ 173.607321][ T6630] kasan_report+0x128/0x150
[ 173.611842][ T6630] ? filp_flush+0x31/0x190
[ 173.616272][ T6630] kasan_check_range+0x264/0x2c0
[ 173.621222][ T6630] filp_flush+0x31/0x190
[ 173.625481][ T6630] filp_close+0x1d/0x40
[ 173.629675][ T6630] gaudio_cleanup+0x54/0xf0
[ 173.634206][ T6630] f_audio_bind+0x4a0/0x630
[ 173.638817][ T6630] ? __pfx_f_audio_bind+0x10/0x10
[ 173.643848][ T6630] ? rcu_is_watching+0x16/0xb0
[ 173.648629][ T6630] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 173.654464][ T6630] usb_add_function+0x290/0x930
[ 173.659418][ T6630] ? check_remote_wakeup_config+0x58/0x1c0
[ 173.665271][ T6630] configfs_composite_bind+0xde0/0x1410
[ 173.670951][ T6630] ? __pfx_configfs_composite_bind+0x10/0x10
[ 173.677034][ T6630] gadget_bind_driver+0x2ca/0x9e0
[ 173.682079][ T6630] ? __pfx_gadget_bind_driver+0x10/0x10
[ 173.687642][ T6630] really_probe+0x254/0xae0
[ 173.692271][ T6630] __driver_probe_device+0x1e8/0x360
[ 173.697604][ T6630] driver_probe_device+0x4f/0x240
[ 173.702664][ T6630] __driver_attach+0x339/0x600
[ 173.707506][ T6630] bus_for_each_dev+0x23e/0x2c0
[ 173.712570][ T6630] ? __pfx___driver_attach+0x10/0x10
[ 173.717883][ T6630] ? __pfx_bus_for_each_dev+0x10/0x10
[ 173.723277][ T6630] ? rt_spin_unlock+0x165/0x200
[ 173.728184][ T6630] bus_add_driver+0x348/0x670
[ 173.732887][ T6630] driver_register+0x23a/0x320
[ 173.737663][ T6630] usb_gadget_register_driver_owner+0xf9/0x270
[ 173.743855][ T6630] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 173.750198][ T6630] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 173.756377][ T6630] configfs_write_iter+0x33a/0x430
[ 173.761560][ T6630] vfs_write+0x61e/0xbb0
[ 173.765820][ T6630] ? __pfx_vfs_write+0x10/0x10
[ 173.770599][ T6630] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 173.776425][ T6630] ? mutex_lock_nested+0x152/0x1d0
[ 173.781542][ T6630] ? fdget_pos+0x252/0x320
[ 173.786149][ T6630] ksys_write+0x156/0x270
[ 173.790491][ T6630] ? __pfx_ksys_write+0x10/0x10
[ 173.795355][ T6630] do_syscall_64+0x166/0x520
[ 173.799957][ T6630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.806038][ T6630] ? clear_bhb_loop+0x70/0xc0
[ 173.810729][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.816720][ T6630] RIP: 0033:0x7f0acb14e0d9
[ 173.821146][ T6630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 173.840766][ T6630] RSP: 002b:00007f0aca7ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 173.849206][ T6630] RAX: ffffffffffffffda RBX: 00007f0acb3d5fa0 RCX: 00007f0acb14e0d9
[ 173.857202][ T6630] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 173.865181][ T6630] RBP: 00007f0acb1e5024 R08: 0000000000000000 R09: 0000000000000000
[ 173.873246][ T6630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 173.881595][ T6630] R13: 00007f0acb3d6038 R14: 00007f0acb3d5fa0 R15: 00007ffda21c5708
[ 173.889600][ T6630]
[ 173.892981][ T6630] Kernel Offset: disabled
[ 173.897306][ T6630] Rebooting in 86400 seconds..