[ 136.040436][ T1029] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 136.040537][ T1029] ata1.00: irq_stat 0x40000000
[ 136.040548][ T1029] ata1.00: failed command: WRITE DMA EXT
[ 136.040555][ T1029] ata1.00: cmd 35/00:40:f6:cd:04/00:05:00:00:00/e0 tag 14 dma 688128 out
[ 136.040555][ T1029] res 41/04:40:f6:cd:04/00:05:00:00:00/e0 Emask 0x1 (device error)
[ 136.040584][ T1029] ata1.00: status: { DRDY ERR }
[ 136.040591][ T1029] ata1.00: error: { ABRT }
[ 136.064919][ T1029] ata1.00: configured for UDMA/100
[ 136.064997][ T1029] ata1: EH complete
[ 137.722471][ T1029] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 137.722495][ T1029] ata1.00: irq_stat 0x40000000
[ 137.722507][ T1029] ata1.00: failed command: WRITE DMA EXT
[ 137.722514][ T1029] ata1.00: cmd 35/00:40:36:e9:04/00:05:00:00:00/e0 tag 14 dma 688128 out
[ 137.722514][ T1029] res 41/04:40:36:e9:04/00:05:00:00:00/e0 Emask 0x1 (device error)
[ 137.722546][ T1029] ata1.00: status: { DRDY ERR }
[ 137.722553][ T1029] ata1.00: error: { ABRT }
[ 137.724252][ T1029] ata1.00: configured for UDMA/100
[ 137.724321][ T1029] ata1: EH complete
[ 138.211073][ T1335] ieee802154 phy0 wpan0: encryption failed: -22
[ 138.211163][ T1335] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '[localhost]:47782' (ED25519) to the list of known hosts.
[ 142.968472][ T1029] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 142.968707][ T1029] ata1.00: irq_stat 0x40000000
[ 142.968720][ T1029] ata1.00: failed command: WRITE DMA EXT
[ 142.968727][ T1029] ata1.00: cmd 35/00:08:36:8a:05/00:14:00:00:00/e0 tag 8 dma 2625536 out
[ 142.968727][ T1029] res 41/04:08:36:8a:05/00:14:00:00:00/e0 Emask 0x1 (device error)
[ 142.968759][ T1029] ata1.00: status: { DRDY ERR }
[ 142.968767][ T1029] ata1.00: error: { ABRT }
[ 142.974313][ T1029] ata1.00: configured for UDMA/100
[ 142.974409][ T1029] ata1: EH complete
2026/11/01 16:26:27 parsed 1 programs
2026/11/01 16:26:27 serving rpc on tcp://44849
Setting up swapspace version 1, size = 127995904 bytes
[ 148.522821][ T5581] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 155.140790][ T5598] bridge0: port 1(bridge_slave_0) entered blocking state
[ 155.141651][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state
[ 155.141756][ T5598] bridge_slave_0: entered allmulticast mode
[ 155.144594][ T5598] bridge_slave_0: entered promiscuous mode
[ 155.161737][ T5598] bridge0: port 2(bridge_slave_1) entered blocking state
[ 155.163476][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state
[ 155.163595][ T5598] bridge_slave_1: entered allmulticast mode
[ 155.167565][ T5598] bridge_slave_1: entered promiscuous mode
[ 155.234849][ T5598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 155.244175][ T5598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 155.295532][ T5598] team0: Port device team_slave_0 added
[ 155.303410][ T5598] team0: Port device team_slave_1 added
[ 155.338467][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 155.338480][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 155.338494][ T5598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 155.339807][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 155.339815][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 155.339828][ T5598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 155.417049][ T5598] hsr_slave_0: entered promiscuous mode
[ 155.417807][ T5598] hsr_slave_1: entered promiscuous mode
[ 156.036880][ T5598] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 156.051134][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 156.052064][ T5598] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 156.057819][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 156.072178][ T5598] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 156.086363][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 156.091858][ T5598] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 156.103216][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 156.282580][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0
[ 156.309478][ T5598] 8021q: adding VLAN 0 to HW filter on device team0
[ 156.317911][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 156.318006][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 156.348003][ T39] bridge0: port 2(bridge_slave_1) entered blocking state
[ 156.348154][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 157.137975][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 157.227802][ T5598] veth0_vlan: entered promiscuous mode
[ 157.254279][ T5598] veth1_vlan: entered promiscuous mode
[ 157.313723][ T5598] veth0_macvtap: entered promiscuous mode
[ 157.325031][ T5598] veth1_macvtap: entered promiscuous mode
[ 157.357313][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 157.376292][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 157.439235][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 157.489199][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 157.520719][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 157.520754][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 157.848900][ T39] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 157.951097][ T39] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 158.522157][ T39] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 159.126368][ T39] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 159.951320][ T39] bridge_slave_1: left allmulticast mode
[ 159.951335][ T39] bridge_slave_1: left promiscuous mode
[ 159.951467][ T39] bridge0: port 2(bridge_slave_1) entered disabled state
[ 159.976179][ T39] bridge_slave_0: left allmulticast mode
[ 159.976201][ T39] bridge_slave_0: left promiscuous mode
[ 159.976347][ T39] bridge0: port 1(bridge_slave_0) entered disabled state
[ 160.431396][ T39] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 160.447379][ T39] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 160.454139][ T39] bond0 (unregistering): Released all slaves
[ 160.551184][ T39] hsr_slave_0: left promiscuous mode
[ 160.551687][ T39] hsr_slave_1: left promiscuous mode
[ 160.552302][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 160.552315][ T39] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 160.553102][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 160.553112][ T39] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 160.586077][ T39] veth1_macvtap: left promiscuous mode
[ 160.586136][ T39] veth0_macvtap: left promiscuous mode
[ 160.586236][ T39] veth1_vlan: left promiscuous mode
[ 160.586351][ T39] veth0_vlan: left promiscuous mode
[ 160.804425][ T39] team0 (unregistering): Port device team_slave_1 removed
[ 160.819151][ T39] team0 (unregistering): Port device team_slave_0 removed
[ 163.323930][ T5006] 8021q: adding VLAN 0 to HW filter on device eth2
[ 164.041030][ T5006] 8021q: adding VLAN 0 to HW filter on device eth3
[ 165.132556][ T5006] 8021q: adding VLAN 0 to HW filter on device eth4
[ 165.354219][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 165.354237][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 165.421013][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 165.421031][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 165.764060][ T5006] 8021q: adding VLAN 0 to HW filter on device eth5
[ 166.189727][ T5390] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 166.192388][ T5390] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 166.192951][ T5390] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 166.195235][ T5390] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 166.195664][ T5390] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2026/11/01 16:26:51 executed programs: 0
[ 167.293564][ T4660] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 167.296659][ T4660] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 167.297289][ T4660] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 167.314418][ T4660] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 167.315153][ T4660] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 167.874718][ T5807] bridge0: port 1(bridge_slave_0) entered blocking state
[ 167.874831][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state
[ 167.874886][ T5807] bridge_slave_0: entered allmulticast mode
[ 167.876033][ T5807] bridge_slave_0: entered promiscuous mode
[ 167.893847][ T5807] bridge0: port 2(bridge_slave_1) entered blocking state
[ 167.893913][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state
[ 167.893999][ T5807] bridge_slave_1: entered allmulticast mode
[ 167.895126][ T5807] bridge_slave_1: entered promiscuous mode
[ 167.932988][ T5807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 167.935001][ T5807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 167.963629][ T5807] team0: Port device team_slave_0 added
[ 167.965585][ T5807] team0: Port device team_slave_1 added
[ 167.989002][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 167.989015][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 167.989029][ T5807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 167.991727][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 167.991735][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 167.991747][ T5807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 168.075036][ T5807] hsr_slave_0: entered promiscuous mode
[ 168.075782][ T5807] hsr_slave_1: entered promiscuous mode
[ 168.655841][ T5807] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 168.669337][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 168.670951][ T5807] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 168.676472][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 168.677384][ T5807] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 168.697881][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 168.706792][ T5807] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 168.717359][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 168.909979][ T5807] 8021q: adding VLAN 0 to HW filter on device bond0
[ 168.942587][ T5807] 8021q: adding VLAN 0 to HW filter on device team0
[ 168.962161][ T14] bridge0: port 1(bridge_slave_0) entered blocking state
[ 168.962232][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 168.986548][ T37] bridge0: port 2(bridge_slave_1) entered blocking state
[ 168.986633][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 169.329436][ T4660] Bluetooth: hci0: command tx timeout
[ 169.777144][ T5807] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 169.861791][ T5807] veth0_vlan: entered promiscuous mode
[ 169.876870][ T5807] veth1_vlan: entered promiscuous mode
[ 169.936726][ T5807] veth0_macvtap: entered promiscuous mode
[ 169.949896][ T5807] veth1_macvtap: entered promiscuous mode
[ 169.981076][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 170.003571][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 170.051949][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 170.051983][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 170.052002][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 170.052020][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 170.192021][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 170.192037][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 170.262371][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 170.262387][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 170.708265][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 170.861185][ T9] usb 5-1: Using ep0 maxpacket: 32
[ 170.866286][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 170.866324][ T9] usb 5-1: New USB device found: idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 170.883767][ T9] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 170.883786][ T9] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 170.883796][ T9] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 170.883806][ T9] usb 5-1: config 3 has no interface number 0
[ 170.883816][ T9] usb 5-1: config 3 has no interface number 1
[ 170.883847][ T9] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 170.883860][ T9] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 170.883874][ T9] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 170.883898][ T9] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 170.883913][ T9] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 170.883929][ T9] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 170.883943][ T9] usb 5-1: config 3 interface 223 has no altsetting 1
[ 170.883953][ T9] usb 5-1: config 3 interface 25 has no altsetting 0
[ 170.886603][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 170.886619][ T9] usb 5-1: Product: syz
[ 170.886627][ T9] usb 5-1: Manufacturer: syz
[ 170.886635][ T9] usb 5-1: SerialNumber: syz
[ 171.187036][ T5872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 171.196844][ T5872] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 171.214742][ T5872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 171.217666][ T5872] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 171.408576][ T4660] Bluetooth: hci0: command tx timeout
[ 171.434529][ T5872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 171.438496][ T5872] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 171.584911][ T9] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 171.604600][ T9] usb 5-1: USB disconnect, device number 2
[ 171.706607][ T5892] udevd[5892]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 171.760109][ T9]
[ 171.761391][ T9] =========================
[ 171.763707][ T9] WARNING: held lock freed!
[ 171.765784][ T9] syzkaller #0 Not tainted
[ 171.767778][ T9] -------------------------
[ 171.769807][ T9] kworker/0:0/9 is freeing memory ffff888030bf9000-ffff888030bf97ff, with a lock still held there!
[ 171.774588][ T9] ffff888030bf91a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa9/0x7d0
[ 171.779421][ T9] locks held by kworker/0:0/9: 5, last CPU#0:
[ 171.782038][ T9] #0: ffff8880313eed48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 171.787065][ T9] #1: ffffc9000022fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 171.792376][ T9] #2: ffff8880332031d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 171.796517][ T9] #3: ffff88804694a1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 171.800307][ T9] #4: ffff888030bf91a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa9/0x7d0
[ 171.804598][ T9]
[ 171.804598][ T9] stack backtrace:
[ 171.806968][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 171.811317][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 171.815481][ T9] Workqueue: usb_hub_wq hub_event
[ 171.817602][ T9] Call Trace:
[ 171.818951][ T9]
[ 171.820229][ T9] dump_stack_lvl+0xe8/0x150
[ 171.824134][ T9] debug_check_no_locks_freed+0x149/0x170
[ 171.826742][ T9] kfree+0x12b/0x650
[ 171.829248][ T9] ? device_release+0xc4/0x1f0
[ 171.831551][ T9] ? __pfx_usb_release_interface+0x10/0x10
[ 171.833929][ T9] device_release+0xc4/0x1f0
[ 171.836065][ T9] kobject_put+0x222/0x550
[ 171.838130][ T9] v4l2_device_disconnect+0x79/0xd0
[ 171.840415][ T9] usbtv_video_free+0x29/0x80
[ 171.842500][ T9] usbtv_disconnect+0x59/0x80
[ 171.844537][ T9] usb_unbind_interface+0x295/0x9c0
[ 171.846706][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 171.849276][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 171.851892][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 171.854402][ T9] device_release_driver_internal+0x48d/0x7d0
[ 171.856953][ T9] bus_remove_device+0x444/0x560
[ 171.859152][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 171.861659][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 171.864172][ T9] device_del+0x524/0x8f0
[ 171.866087][ T9] ? __pfx_device_del+0x10/0x10
[ 171.868227][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 171.870463][ T9] usb_disable_device+0x3d4/0x8d0
[ 171.872721][ T9] usb_disconnect+0x346/0x9a0
[ 171.874847][ T9] hub_event+0x1bbb/0x4d30
[ 171.876789][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 171.878948][ T9] ? register_lock_class+0x31/0x2e0
[ 171.881186][ T9] ? __pfx_hub_event+0x10/0x10
[ 171.883280][ T9] ? rcu_is_watching+0x16/0xb0
[ 171.885417][ T9] ? process_scheduled_works+0x97a/0x1630
[ 171.887858][ T9] process_scheduled_works+0xc3d/0x1630
[ 171.890258][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 171.892858][ T9] ? assign_work+0x3cf/0x5d0
[ 171.894945][ T9] worker_thread+0xa47/0xfb0
[ 171.896931][ T9] kthread+0x38b/0x480
[ 171.898704][ T9] ? __pfx_worker_thread+0x10/0x10
[ 171.900952][ T9] ? __pfx_kthread+0x10/0x10
[ 171.903044][ T9] ret_from_fork+0x514/0xb70
[ 171.905054][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 171.907346][ T9] ? __switch_to+0xc78/0x1410
[ 171.909707][ T9] ? __pfx_kthread+0x10/0x10
[ 171.912256][ T9] ret_from_fork_asm+0x1a/0x30
[ 171.914600][ T9]
[ 171.961457][ T9] ==================================================================
[ 171.961469][ T9] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9c0
[ 171.961493][ T9] Read of size 8 at addr ffff888030bf9008 by task kworker/0:0/9
[ 171.961503][ T9]
[ 171.961510][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 171.961523][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 171.961531][ T9] Workqueue: usb_hub_wq hub_event
[ 171.961549][ T9] Call Trace:
[ 171.961554][ T9]
[ 171.961559][ T9] dump_stack_lvl+0xe8/0x150
[ 171.961579][ T9] print_address_description+0x55/0x1e0
[ 171.961596][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 171.961611][ T9] print_report+0x58/0x70
[ 171.961626][ T9] kasan_report+0x117/0x150
[ 171.961648][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 171.961664][ T9] usb_unbind_interface+0x2c2/0x9c0
[ 171.961678][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 171.961693][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 171.961705][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 171.961719][ T9] device_release_driver_internal+0x48d/0x7d0
[ 171.961734][ T9] bus_remove_device+0x444/0x560
[ 171.961749][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 171.961763][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 171.961775][ T9] device_del+0x524/0x8f0
[ 171.961793][ T9] ? __pfx_device_del+0x10/0x10
[ 171.961808][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 171.961848][ T9] usb_disable_device+0x3d4/0x8d0
[ 171.961864][ T9] usb_disconnect+0x346/0x9a0
[ 171.961878][ T9] hub_event+0x1bbb/0x4d30
[ 171.961891][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 171.961906][ T9] ? register_lock_class+0x31/0x2e0
[ 171.961948][ T9] ? __pfx_hub_event+0x10/0x10
[ 171.961965][ T9] ? rcu_is_watching+0x16/0xb0
[ 171.961982][ T9] ? process_scheduled_works+0x97a/0x1630
[ 171.962000][ T9] process_scheduled_works+0xc3d/0x1630
[ 171.962023][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 171.962041][ T9] ? assign_work+0x3cf/0x5d0
[ 171.962058][ T9] worker_thread+0xa47/0xfb0
[ 171.962074][ T9] kthread+0x38b/0x480
[ 171.962087][ T9] ? __pfx_worker_thread+0x10/0x10
[ 171.962097][ T9] ? __pfx_kthread+0x10/0x10
[ 171.962109][ T9] ret_from_fork+0x514/0xb70
[ 171.962123][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 171.962134][ T9] ? __switch_to+0xc78/0x1410
[ 171.962145][ T9] ? __pfx_kthread+0x10/0x10
[ 171.962157][ T9] ret_from_fork_asm+0x1a/0x30
[ 171.962173][ T9]
[ 171.962177][ T9]
[ 171.962180][ T9] Allocated by task 9:
[ 171.962198][ T9] kasan_save_track+0x3e/0x80
[ 171.962211][ T9] __kasan_kmalloc+0x93/0xb0
[ 171.962224][ T9] __kmalloc_cache_noprof+0x31c/0x600
[ 171.962236][ T9] usb_set_configuration+0x3c5/0x2260
[ 171.962251][ T9] usb_generic_driver_probe+0x8d/0x150
[ 171.962271][ T9] usb_probe_device+0x1c3/0x3b0
[ 171.962286][ T9] really_probe+0x254/0xae0
[ 171.962300][ T9] __driver_probe_device+0x1e8/0x360
[ 171.962310][ T9] driver_probe_device+0x4f/0x240
[ 171.962320][ T9] __device_attach_driver+0x270/0x410
[ 171.962330][ T9] bus_for_each_drv+0x258/0x2f0
[ 171.962341][ T9] __device_attach+0x2bd/0x430
[ 171.962356][ T9] device_initial_probe+0x9c/0x100
[ 171.962371][ T9] __bus_probe_device+0x126/0x220
[ 171.962383][ T9] device_add+0x7d7/0xb80
[ 171.962396][ T9] usb_new_device+0x9aa/0x1690
[ 171.962408][ T9] hub_event+0x28e8/0x4d30
[ 171.962422][ T9] process_scheduled_works+0xc3d/0x1630
[ 171.962437][ T9] worker_thread+0xa47/0xfb0
[ 171.962445][ T9] kthread+0x38b/0x480
[ 171.962457][ T9] ret_from_fork+0x514/0xb70
[ 171.962467][ T9] ret_from_fork_asm+0x1a/0x30
[ 171.962478][ T9]
[ 171.962481][ T9] Freed by task 9:
[ 171.962486][ T9] kasan_save_track+0x3e/0x80
[ 171.962498][ T9] kasan_save_free_info+0x40/0x50
[ 171.962508][ T9] __kasan_slab_free+0x5c/0x80
[ 171.962520][ T9] kfree+0x1c5/0x650
[ 171.962528][ T9] device_release+0xc4/0x1f0
[ 171.962538][ T9] kobject_put+0x222/0x550
[ 171.962548][ T9] v4l2_device_disconnect+0x79/0xd0
[ 171.962559][ T9] usbtv_video_free+0x29/0x80
[ 171.962568][ T9] usbtv_disconnect+0x59/0x80
[ 171.962578][ T9] usb_unbind_interface+0x295/0x9c0
[ 171.962592][ T9] device_release_driver_internal+0x48d/0x7d0
[ 171.962601][ T9] bus_remove_device+0x444/0x560
[ 171.962613][ T9] device_del+0x524/0x8f0
[ 171.962626][ T9] usb_disable_device+0x3d4/0x8d0
[ 171.962674][ T9] usb_disconnect+0x346/0x9a0
[ 171.962687][ T9] hub_event+0x1bbb/0x4d30
[ 171.962700][ T9] process_scheduled_works+0xc3d/0x1630
[ 171.962714][ T9] worker_thread+0xa47/0xfb0
[ 171.962722][ T9] kthread+0x38b/0x480
[ 171.962733][ T9] ret_from_fork+0x514/0xb70
[ 171.962743][ T9] ret_from_fork_asm+0x1a/0x30
[ 171.962754][ T9]
[ 171.962757][ T9] The buggy address belongs to the object at ffff888030bf9000
[ 171.962757][ T9] which belongs to the cache kmalloc-2k of size 2048
[ 171.962767][ T9] The buggy address is located 8 bytes inside of
[ 171.962767][ T9] freed 2048-byte region [ffff888030bf9000, ffff888030bf9800)
[ 171.962778][ T9]
[ 171.962781][ T9] The buggy address belongs to the physical page:
[ 171.962787][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x30bf8
[ 171.962798][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 171.962807][ T9] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 171.962817][ T9] page_type: f5(slab)
[ 171.962828][ T9] raw: 04fff00000000040 ffff88801c842000 dead000000000100 dead000000000122
[ 171.962838][ T9] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 171.962847][ T9] head: 04fff00000000040 ffff88801c842000 dead000000000100 dead000000000122
[ 171.962856][ T9] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 171.962865][ T9] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 171.962873][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 171.962878][ T9] page dumped because: kasan: bad access detected
[ 171.962884][ T9] page_owner tracks the page as allocated
[ 171.962888][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4698, tgid 4698 (klogd), ts 32854601132
[ 171.962905][ T9] post_alloc_hook+0x1f9/0x250
[ 171.962916][ T9] get_page_from_freelist+0x220f/0x2280
[ 171.962928][ T9] __alloc_frozen_pages_noprof+0x1fe/0x410
[ 171.962939][ T9] allocate_slab+0x7d/0x5e0
[ 171.962953][ T9] refill_objects+0x2d5/0x350
[ 171.962968][ T9] __pcs_replace_empty_main+0x2c8/0x6c0
[ 171.962981][ T9] __kmalloc_cache_noprof+0x396/0x600
[ 171.962992][ T9] syslog_print+0x103/0x610
[ 171.963006][ T9] do_syslog+0x583/0x7d0
[ 171.963019][ T9] __x64_sys_syslog+0x7c/0x90
[ 171.963033][ T9] do_syscall_64+0x166/0x520
[ 171.963046][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.963058][ T9] page last free pid 4699 tgid 4699 ts 32167495423 stack trace:
[ 171.963066][ T9] __free_frozen_pages+0xc97/0xd90
[ 171.963076][ T9] __slab_free+0x269/0x2c0
[ 171.963086][ T9] qlist_free_all+0x99/0x100
[ 171.963097][ T9] kasan_quarantine_reduce+0x148/0x160
[ 171.963109][ T9] __kasan_slab_alloc+0x22/0x80
[ 171.963121][ T9] __kmalloc_cache_noprof+0x29a/0x600
[ 171.963132][ T9] tomoyo_init_log+0x187/0x1f60
[ 171.963194][ T9] tomoyo_supervisor+0x35f/0x1550
[ 171.963209][ T9] tomoyo_path_permission+0x262/0x3b0
[ 171.963221][ T9] tomoyo_path_perm+0x3f3/0x560
[ 171.963233][ T9] security_inode_getattr+0x12b/0x310
[ 171.963243][ T9] __se_sys_newfstat+0x133/0x440
[ 171.963254][ T9] do_syscall_64+0x166/0x520
[ 171.963266][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.963277][ T9]
[ 171.963279][ T9] Memory state around the buggy address:
[ 171.963286][ T9] ffff888030bf8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 171.963294][ T9] ffff888030bf8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 171.963301][ T9] >ffff888030bf9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 171.963306][ T9] ^
[ 171.963312][ T9] ffff888030bf9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 171.963319][ T9] ffff888030bf9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 171.963325][ T9] ==================================================================
[ 171.963383][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 172.325761][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 172.329651][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 172.333833][ T9] Workqueue: usb_hub_wq hub_event
[ 172.336102][ T9] Call Trace:
[ 172.337653][ T9]
[ 172.338935][ T9] vpanic+0x26f/0x710
[ 172.340783][ T9] panic+0xc5/0xd0
[ 172.342407][ T9] ? __pfx_panic+0x10/0x10
[ 172.344399][ T9] ? preempt_schedule_thunk+0x16/0x40
[ 172.346769][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 172.349033][ T9] ? preempt_schedule_thunk+0x16/0x40
[ 172.351404][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 172.353747][ T9] check_panic_on_warn+0x89/0xb0
[ 172.355869][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 172.358272][ T9] end_report+0x73/0x170
[ 172.360331][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 172.362743][ T9] kasan_report+0x128/0x150
[ 172.364758][ T9] ? usb_unbind_interface+0x2c2/0x9c0
[ 172.367164][ T9] usb_unbind_interface+0x2c2/0x9c0
[ 172.369458][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 172.372012][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 172.374473][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 172.376828][ T9] device_release_driver_internal+0x48d/0x7d0
[ 172.379511][ T9] bus_remove_device+0x444/0x560
[ 172.381677][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 172.384156][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 172.386712][ T9] device_del+0x524/0x8f0
[ 172.388697][ T9] ? __pfx_device_del+0x10/0x10
[ 172.390866][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 172.393114][ T9] usb_disable_device+0x3d4/0x8d0
[ 172.395376][ T9] usb_disconnect+0x346/0x9a0
[ 172.397567][ T9] hub_event+0x1bbb/0x4d30
[ 172.399656][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 172.402011][ T9] ? register_lock_class+0x31/0x2e0
[ 172.404331][ T9] ? __pfx_hub_event+0x10/0x10
[ 172.406391][ T9] ? rcu_is_watching+0x16/0xb0
[ 172.408506][ T9] ? process_scheduled_works+0x97a/0x1630
[ 172.411089][ T9] process_scheduled_works+0xc3d/0x1630
[ 172.413662][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 172.416411][ T9] ? assign_work+0x3cf/0x5d0
[ 172.418779][ T9] worker_thread+0xa47/0xfb0
[ 172.421548][ T9] kthread+0x38b/0x480
[ 172.423946][ T9] ? __pfx_worker_thread+0x10/0x10
[ 172.426740][ T9] ? __pfx_kthread+0x10/0x10
[ 172.428806][ T9] ret_from_fork+0x514/0xb70
[ 172.430916][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 172.432991][ T9] ? __switch_to+0xc78/0x1410
[ 172.434956][ T9] ? __pfx_kthread+0x10/0x10
[ 172.436797][ T9] ret_from_fork_asm+0x1a/0x30
[ 172.438871][ T9]
[ 172.440915][ T9] Kernel Offset: disabled
[ 172.442869][ T9] Rebooting in 86400 seconds..