Warning: Permanently added '10.128.0.157' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://39591 [ 31.735239][ T4340] cgroup: Unknown subsys name 'net' [ 31.957434][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.230956][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 35.566490][ T4365] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.568274][ T4365] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.569696][ T4365] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.571218][ T4365] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.572748][ T4365] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 35.574158][ T4365] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.712663][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.714126][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.716105][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 35.725336][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.726702][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.728084][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 35.863767][ T4384] chnl_net:caif_netlink_parms(): no params data found [ 35.882493][ T4384] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.883860][ T4384] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.885824][ T4384] device bridge_slave_0 entered promiscuous mode [ 35.888187][ T4384] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.889346][ T4384] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.890888][ T4384] device bridge_slave_1 entered promiscuous mode [ 35.897832][ T4384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.900320][ T4384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.909472][ T4384] team0: Port device team_slave_0 added [ 35.911231][ T4384] team0: Port device team_slave_1 added [ 35.916860][ T4384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.918158][ T4384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.922491][ T4384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.925498][ T4384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.926548][ T4384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.930687][ T4384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.985822][ T4384] device hsr_slave_0 entered promiscuous mode [ 36.034933][ T4384] device hsr_slave_1 entered promiscuous mode [ 36.148137][ T4384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 36.196512][ T4384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 36.246100][ T4384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 36.305971][ T4384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 36.342740][ T4384] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.344226][ T4384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.345732][ T4384] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.347036][ T4384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.365762][ T4384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.369851][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.372162][ T4385] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.374001][ T4385] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.379425][ T4384] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.382242][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.383993][ T4385] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.385438][ T4385] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.389810][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.391358][ T4385] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.392555][ T4385] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.398715][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 36.400474][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 36.403347][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 36.407872][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.410763][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.413310][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 36.467390][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 36.468720][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 36.472404][ T4384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.478474][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.485860][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.487844][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.489472][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.498080][ T4384] device veth0_vlan entered promiscuous mode [ 36.501232][ T4384] device veth1_vlan entered promiscuous mode [ 36.508432][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.510016][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.511625][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.514018][ T4384] device veth0_macvtap entered promiscuous mode [ 36.523765][ T4384] device veth1_macvtap entered promiscuous mode [ 36.530849][ T4384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.532296][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.534352][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.538010][ T4384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.539375][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.541992][ T4384] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.543474][ T4384] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.545016][ T4384] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.546367][ T4384] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:38 executed programs: 0 [ 38.235216][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.237203][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.238627][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.240962][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.242464][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 38.243899][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.467439][ T39] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.509883][ T4443] chnl_net:caif_netlink_parms(): no params data found [ 38.524139][ T4443] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.525713][ T4443] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.527339][ T4443] device bridge_slave_0 entered promiscuous mode [ 38.529671][ T4443] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.530804][ T4443] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.532355][ T4443] device bridge_slave_1 entered promiscuous mode [ 38.538693][ T4443] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.541051][ T4443] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.547434][ T4443] team0: Port device team_slave_0 added [ 38.549395][ T4443] team0: Port device team_slave_1 added [ 38.555144][ T4443] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.556342][ T4443] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.560513][ T4443] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.562954][ T4443] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.563986][ T4443] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.568908][ T4443] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.625815][ T4443] device hsr_slave_0 entered promiscuous mode [ 38.664901][ T4443] device hsr_slave_1 entered promiscuous mode [ 38.704774][ T4443] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.706138][ T4443] Cannot create hsr debugfs directory [ 40.314963][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 40.965452][ T39] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.394784][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 42.516247][ T39] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.616555][ T39] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.569139][ T4443] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 43.680394][ T4443] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 43.725736][ T4443] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 43.846683][ T4443] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 43.965018][ T4443] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.969000][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.970587][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.972999][ T4443] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.975614][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.977280][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.978812][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.980103][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.981665][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 43.984258][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.986651][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.988191][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.989398][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.018915][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.021922][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.025435][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.027285][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.028973][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.031538][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.033197][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.037272][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.038794][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.041352][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.042936][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.046035][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.129160][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.130623][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.133660][ T4443] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.139579][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 44.141307][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.146555][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 44.148208][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.149886][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.151369][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.153514][ T4443] device veth0_vlan entered promiscuous mode [ 44.161027][ T4443] device veth1_vlan entered promiscuous mode [ 44.219221][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 44.220870][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 44.222581][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.224202][ T1615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.226906][ T4443] device veth0_macvtap entered promiscuous mode [ 44.229149][ T4443] device veth1_macvtap entered promiscuous mode [ 44.233464][ T4443] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.235583][ T4443] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.237658][ T4443] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 44.238927][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 44.240578][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 44.242073][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.243730][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.247342][ T4443] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 44.249066][ T4443] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.251213][ T4443] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 44.252426][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.254411][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.288745][ T4443] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.290238][ T4443] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.291748][ T4443] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.293192][ T4443] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.310297][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.311687][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.312983][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 44.321307][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.322685][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.324219][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 44.337316][ T39] device hsr_slave_0 left promiscuous mode [ 44.359165][ T4505] vhci_hcd vhci_hcd.0: remove, state 4 [ 44.360372][ T4505] usb usb3: USB disconnect, device number 1 [ 44.367918][ T9] vhci_hcd: stop threads [ 44.368711][ T9] vhci_hcd: release socket [ 44.369499][ T9] vhci_hcd: disconnect device [ 44.370332][ T9] vhci_hcd: stop threads [ 44.370975][ T9] vhci_hcd: release socket [ 44.371663][ T9] vhci_hcd: disconnect device [ 44.372558][ T4505] vhci_hcd vhci_hcd.0: USB bus 3 deregistered [ 44.374411][ T9] vhci_hcd: stop threads [ 44.375548][ T39] device hsr_slave_1 left promiscuous mode [ 44.375701][ T9] vhci_hcd: release socket [ 44.377426][ T9] vhci_hcd: disconnect device [ 44.377644][ T4505] vhci_hcd vhci_hcd.0: remove, state 4 [ 44.378261][ T9] ================================================================== [ 44.379314][ T4505] usb usb2: USB disconnect, device number 1 [ 44.380679][ T9] BUG: KASAN: use-after-free in __lock_acquire+0x104/0x6634 [ 44.382772][ T9] Read of size 8 at addr ffff0000d1ce48f0 by task kworker/u4:0/9 [ 44.384031][ T9] [ 44.384423][ T9] CPU: 1 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 44.385700][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 44.387430][ T9] Workqueue: usbip_event event_handler [ 44.388426][ T9] Call trace: [ 44.389018][ T9] dump_backtrace+0x1c4/0x1f0 [ 44.389868][ T9] show_stack+0x2c/0x3c [ 44.390628][ T9] __dump_stack+0x30/0x40 [ 44.391400][ T9] dump_stack_lvl+0xf4/0x15c [ 44.392145][ T9] print_address_description+0x88/0x218 [ 44.393101][ T9] print_report+0x50/0x68 [ 44.393875][ T9] kasan_report+0xa8/0xfc [ 44.394604][ T9] __asan_report_load8_noabort+0x2c/0x38 [ 44.395585][ T9] __lock_acquire+0x104/0x6634 [ 44.396420][ T9] lock_acquire+0x20c/0x638 [ 44.397163][ T9] _raw_spin_lock_irqsave+0x6c/0xb0 [ 44.398084][ T9] event_handler+0x290/0x454 [ 44.398835][ T4505] vhci_hcd vhci_hcd.0: USB bus 2 deregistered [ 44.398881][ T9] process_one_work+0x7e4/0x13bc [ 44.400724][ T9] worker_thread+0x8cc/0xfe8 [ 44.401568][ T9] kthread+0x254/0x2e0 [ 44.402306][ T9] ret_from_fork+0x10/0x20 [ 44.403074][ T9] [ 44.403442][ T9] Allocated by task 1: [ 44.404136][ T9] kasan_set_track+0x4c/0x80 [ 44.404905][ T9] kasan_save_alloc_info+0x24/0x30 [ 44.405761][ T9] __kasan_kmalloc+0xa0/0xb8 [ 44.406529][ T9] __kmalloc+0xd8/0x180 [ 44.407200][ T9] __usb_create_hcd+0x6c/0x740 [ 44.407978][ T9] usb_create_shared_hcd+0x40/0x54 [ 44.408972][ T9] vhci_hcd_probe+0x1a4/0x354 [ 44.409813][ T9] platform_probe+0x148/0x1c8 [ 44.410689][ T9] really_probe+0x3a0/0xac4 [ 44.411509][ T9] __driver_probe_device+0x1c8/0x368 [ 44.412473][ T9] driver_probe_device+0x78/0x324 [ 44.413322][ T9] __device_attach_driver+0x28c/0x4c0 [ 44.414267][ T9] bus_for_each_drv+0x154/0x1e4 [ 44.415146][ T9] __device_attach+0x2a4/0x3d8 [ 44.415977][ T9] device_initial_probe+0x24/0x34 [ 44.416831][ T9] bus_probe_device+0xbc/0x1c4 [ 44.417668][ T9] device_add+0x93c/0xe4c [ 44.418443][ T9] platform_device_add+0x3f8/0x6f4 [ 44.419347][ T9] vhci_hcd_init+0x390/0x4b0 [ 44.420125][ T9] do_one_initcall+0x278/0x9f0 [ 44.420946][ T9] do_initcall_level+0x158/0x214 [ 44.421804][ T9] do_initcalls+0x58/0xac [ 44.422521][ T9] do_basic_setup+0x8c/0xa0 [ 44.423306][ T9] kernel_init_freeable+0x35c/0x4f0 [ 44.424196][ T9] kernel_init+0x24/0x1d8 [ 44.424961][ T9] ret_from_fork+0x10/0x20 [ 44.425733][ T9] [ 44.426133][ T9] Freed by task 4505: [ 44.426819][ T9] kasan_set_track+0x4c/0x80 [ 44.427593][ T9] kasan_save_free_info+0x38/0x5c [ 44.428485][ T9] ____kasan_slab_free+0x148/0x1b0 [ 44.429383][ T9] __kasan_slab_free+0x18/0x28 [ 44.430237][ T9] slab_free_freelist_hook+0x16c/0x1e8 [ 44.431128][ T9] __kmem_cache_free+0xbc/0x21c [ 44.431925][ T9] kfree+0xd0/0x1a8 [ 44.432579][ T9] usb_put_hcd+0x124/0x16c [ 44.433347][ T9] vhci_hcd_remove+0x98/0x100 [ 44.434186][ T9] platform_remove+0x98/0xf0 [ 44.434996][ T9] device_release_driver_internal+0x3d4/0x6e4 [ 44.436064][ T9] device_driver_detach+0x48/0x58 [ 44.436891][ T9] unbind_store+0x2a8/0x2b4 [ 44.437661][ T9] drv_attr_store+0x80/0xa4 [ 44.438419][ T9] sysfs_kf_write+0x1f8/0x274 [ 44.439253][ T9] kernfs_fop_write_iter+0x390/0x4b4 [ 44.440137][ T9] vfs_write+0x3c8/0x7c8 [ 44.440833][ T9] ksys_write+0x12c/0x228 [ 44.441650][ T9] __arm64_sys_write+0x7c/0x90 [ 44.442555][ T9] invoke_syscall+0x98/0x290 [ 44.443341][ T9] el0_svc_common+0x13c/0x258 [ 44.444221][ T9] do_el0_svc+0x5c/0x134 [ 44.444985][ T9] el0_svc+0x58/0x128 [ 44.445638][ T9] el0t_64_sync_handler+0x84/0xf0 [ 44.446539][ T9] el0t_64_sync+0x18c/0x190 [ 44.447282][ T9] [ 44.447659][ T9] The buggy address belongs to the object at ffff0000d1ce4000 [ 44.447659][ T9] which belongs to the cache kmalloc-8k of size 8192 [ 44.449962][ T9] The buggy address is located 2288 bytes inside of [ 44.449962][ T9] 8192-byte region [ffff0000d1ce4000, ffff0000d1ce6000) [ 44.452345][ T9] [ 44.452763][ T9] The buggy address belongs to the physical page: [ 44.453859][ T9] page:00000000c8b08ede refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111ce0 [ 44.455557][ T9] head:00000000c8b08ede order:3 compound_mapcount:0 compound_pincount:0 [ 44.457011][ T9] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 44.458378][ T9] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002c00 [ 44.459837][ T9] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 44.461283][ T9] page dumped because: kasan: bad access detected [ 44.462384][ T9] [ 44.462799][ T9] Memory state around the buggy address: [ 44.463715][ T9] ffff0000d1ce4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.465032][ T9] ffff0000d1ce4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.466457][ T9] >ffff0000d1ce4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.467895][ T9] ^ [ 44.469257][ T9] ffff0000d1ce4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.470602][ T9] ffff0000d1ce4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.471990][ T9] ================================================================== [ 44.473375][ T9] Disabling lock debugging due to kernel taint [ 44.474719][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 44.487790][ T9] vhci_hcd: stop threads [ 44.488621][ T9] vhci_hcd: release socket [ 44.489377][ T9] vhci_hcd: disconnect device [ 44.490303][ T9] vhci_hcd: stop threads [ 44.491127][ T9] vhci_hcd: release socket [ 44.492007][ T9] vhci_hcd: disconnect device [ 44.492876][ T9] vhci_hcd: stop threads [ 44.493564][ T9] vhci_hcd: release socket [ 44.494294][ T9] vhci_hcd: disconnect device [ 44.495504][ T9] vhci_hcd: stop threads [ 44.496232][ T9] vhci_hcd: release socket [ 44.496941][ T9] vhci_hcd: disconnect device [ 44.497703][ T9] vhci_hcd: stop threads [ 44.498337][ T9] vhci_hcd: release socket [ 44.499095][ T9] vhci_hcd: disconnect device [ 44.499894][ T9] vhci_hcd: stop threads [ 44.500600][ T9] vhci_hcd: release socket [ 44.501361][ T9] vhci_hcd: disconnect device [ 44.502164][ T9] vhci_hcd: stop threads [ 44.502917][ T9] vhci_hcd: release socket [ 44.503652][ T9] vhci_hcd: disconnect device [ 44.504450][ T9] vhci_hcd: stop threads [ 44.505715][ T9] vhci_hcd: release socket [ 44.506528][ T9] vhci_hcd: disconnect device [ 44.507358][ T9] vhci_hcd: stop threads [ 44.508034][ T9] vhci_hcd: release socket [ 44.508845][ T9] vhci_hcd: disconnect device [ 44.509636][ T9] vhci_hcd: stop threads [ 44.510372][ T9] vhci_hcd: release socket [ 44.511127][ T9] vhci_hcd: disconnect device [ 44.511882][ T9] vhci_hcd: stop threads [ 44.512624][ T9] vhci_hcd: release socket [ 44.513409][ T9] vhci_hcd: disconnect device [ 44.514188][ T9] vhci_hcd: stop threads [ 44.516093][ T9] vhci_hcd: release socket [ 44.516885][ T9] vhci_hcd: disconnect device [ 44.517704][ T9] vhci_hcd: stop threads [ 44.518372][ T9] vhci_hcd: release socket [ 44.519072][ T9] vhci_hcd: disconnect device [ 44.534749][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.536052][ T39] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 44.537518][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.538792][ T39] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 44.540164][ T39] device bridge_slave_1 left promiscuous mode [ 44.541206][ T39] bridge0: port 2(bridge_slave_1) entered disabled state