Warning: Permanently added '10.128.1.245' (ED25519) to the list of known hosts. 2025/08/17 03:17:28 ignoring optional flag "sandboxArg"="0" 2025/08/17 03:17:29 parsed 1 programs [ 94.742379][ T6198] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 97.042483][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.050123][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.060931][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.068745][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.076691][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.512400][ T6235] chnl_net:caif_netlink_parms(): no params data found [ 97.546840][ T6235] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.554509][ T6235] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.561693][ T6235] bridge_slave_0: entered allmulticast mode [ 97.568837][ T6235] bridge_slave_0: entered promiscuous mode [ 97.575939][ T6235] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.583012][ T6235] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.590392][ T6235] bridge_slave_1: entered allmulticast mode [ 97.597303][ T6235] bridge_slave_1: entered promiscuous mode [ 97.616884][ T6235] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.627583][ T6235] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.648411][ T6235] team0: Port device team_slave_0 added [ 97.655809][ T6235] team0: Port device team_slave_1 added [ 97.672856][ T6235] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.679960][ T6235] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.706250][ T6235] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.718834][ T6235] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.725987][ T6235] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.752167][ T6235] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.780884][ T6235] hsr_slave_0: entered promiscuous mode [ 97.786989][ T6235] hsr_slave_1: entered promiscuous mode [ 98.062244][ T6235] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.075481][ T6235] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.085084][ T6235] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.095182][ T6235] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.118363][ T6235] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.125944][ T6235] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.133687][ T6235] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.140883][ T6235] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.191399][ T6235] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.206651][ T152] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.215796][ T152] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.229172][ T6235] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.240467][ T2969] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.247710][ T2969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.265653][ T152] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.272775][ T152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.430848][ T6235] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.469511][ T6235] veth0_vlan: entered promiscuous mode [ 98.481352][ T6235] veth1_vlan: entered promiscuous mode [ 98.507597][ T6235] veth0_macvtap: entered promiscuous mode [ 98.516584][ T6235] veth1_macvtap: entered promiscuous mode [ 98.536383][ T6235] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.549829][ T6235] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.562528][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.573192][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.586311][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.598368][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.689748][ T2969] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.742483][ T2969] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.812586][ T2969] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.890742][ T2969] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.938290][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.955906][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.976853][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.989433][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/08/17 03:17:39 executed programs: 0 [ 100.981031][ T5912] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.989012][ T5912] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.998821][ T5912] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.006659][ T5912] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.014563][ T5912] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 101.160276][ T6430] chnl_net:caif_netlink_parms(): no params data found [ 101.220192][ T6430] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.228195][ T6430] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.235469][ T6430] bridge_slave_0: entered allmulticast mode [ 101.242479][ T6430] bridge_slave_0: entered promiscuous mode [ 101.250633][ T6430] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.257871][ T6430] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.265104][ T6430] bridge_slave_1: entered allmulticast mode [ 101.271983][ T6430] bridge_slave_1: entered promiscuous mode [ 101.297824][ T6430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.309306][ T6430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.339022][ T6430] team0: Port device team_slave_0 added [ 101.349281][ T6430] team0: Port device team_slave_1 added [ 101.377873][ T6430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.385328][ T6430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.415173][ T6430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.427260][ T6430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.435090][ T6430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.462885][ T6430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.504601][ T6430] hsr_slave_0: entered promiscuous mode [ 101.510828][ T6430] hsr_slave_1: entered promiscuous mode [ 101.517922][ T6430] debugfs: 'hsr0' already exists in 'hsr' [ 101.524350][ T6430] Cannot create hsr debugfs directory [ 101.771671][ T2969] bridge_slave_1: left allmulticast mode [ 101.777931][ T2969] bridge_slave_1: left promiscuous mode [ 101.784856][ T2969] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.793517][ T2969] bridge_slave_0: left allmulticast mode [ 101.800630][ T2969] bridge_slave_0: left promiscuous mode [ 101.806998][ T2969] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.909771][ T2969] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 101.920061][ T2969] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 101.931253][ T2969] bond0 (unregistering): Released all slaves [ 102.010001][ T2969] hsr_slave_0: left promiscuous mode [ 102.016090][ T2969] hsr_slave_1: left promiscuous mode [ 102.021995][ T2969] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.030567][ T2969] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 102.038765][ T2969] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.047238][ T2969] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 102.061397][ T2969] veth1_macvtap: left promiscuous mode [ 102.067951][ T2969] veth0_macvtap: left promiscuous mode [ 102.073540][ T2969] veth1_vlan: left promiscuous mode [ 102.079201][ T2969] veth0_vlan: left promiscuous mode [ 102.221445][ T2969] team0 (unregistering): Port device team_slave_1 removed [ 102.237501][ T2969] team0 (unregistering): Port device team_slave_0 removed [ 102.416945][ T6430] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.431476][ T6430] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.442176][ T6430] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.452138][ T6430] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.529960][ T6430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.551031][ T6430] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.567573][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.574741][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.604506][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.611607][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.874131][ T6430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.898735][ T6430] veth0_vlan: entered promiscuous mode [ 102.907451][ T6430] veth1_vlan: entered promiscuous mode [ 102.940246][ T6430] veth0_macvtap: entered promiscuous mode [ 102.948784][ T6430] veth1_macvtap: entered promiscuous mode [ 102.961712][ T6430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.978839][ T6430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.002791][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.012192][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.023055][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.032497][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.043726][ T5912] Bluetooth: hci0: command tx timeout [ 103.078400][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.088921][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.120674][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.135436][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.393810][ T6268] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 103.545361][ T6268] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.555774][ T6268] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 103.570523][ T6268] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 103.579992][ T6268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.591007][ T6268] usb 1-1: Product: syz [ 103.595339][ T6268] usb 1-1: Manufacturer: syz [ 103.599941][ T6268] usb 1-1: SerialNumber: syz [ 103.808225][ T6520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.816926][ T6520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.830183][ T6268] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 103.840517][ T6268] usb 1-1: USB disconnect, device number 2 [ 104.263800][ T5979] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 104.413780][ T5979] usb 1-1: Using ep0 maxpacket: 8 [ 104.420247][ T5979] usb 1-1: config index 0 descriptor too short (expected 301, got 72) [ 104.428645][ T5979] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 104.438969][ T5979] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 104.448906][ T5979] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 104.459112][ T5979] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 104.469504][ T5979] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.480494][ T5979] usb 1-1: config 16 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 104.494092][ T5979] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 104.503138][ T5979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.713940][ T5979] usb 1-1: usb_control_msg returned -32 [ 104.719532][ T5979] usbtmc 1-1:16.0: can't read capabilities [ 104.726177][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.732150][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.738263][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.744276][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.750374][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.756376][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.762378][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.768367][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.774429][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.780439][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.786434][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.792421][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.798531][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.804778][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.810793][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.818254][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.824607][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.830671][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.836666][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.842749][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.848850][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.855104][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.861260][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.867247][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.873316][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.879293][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.885299][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.891389][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.897466][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.903483][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.909639][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.915636][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.921681][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.927985][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.934038][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.940028][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.946016][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.952090][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.958073][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.964252][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.970387][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.976881][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.983212][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.989228][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 104.995312][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.001322][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.007299][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.013375][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.019556][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.025655][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.031666][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.037650][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.043825][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.049987][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.056215][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.062256][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.068361][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.074372][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.080347][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.086343][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.092556][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.098679][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.104660][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.110664][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.116737][ C1] usbtmc 1-1:16.0: invalid notification: 11 [ 105.122970][ C1] usbtmc 1-1:16.0: invalid notification: 1 [ 105.129188][ T5912] Bluetooth: hci0: command tx timeout [ 105.134707][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.140654][ C1] usbtmc 1-1:16.0: invalid notification: 0 [ 105.146628][ C1] usbtmc 1-1:16.0: invalid notification: 73 [ 105.152600][ C1] usbtmc 1-1:16.0: invalid notification: 33 [ 105.158689][ C1] usbtmc 1-1:16.0: invalid notification: 36 [ 105.164677][ C1] usbtmc 1-1:16.0: invalid notification: 8 [ 105.170628][ C1] ================================================================== [ 105.170646][ C1] BUG: KASAN: slab-out-of-bounds in usbtmc_interrupt+0x4c7/0x690 [ 105.170680][ C1] Read of size 1 at addr ffff88801eac7cc1 by task kworker/u9:2/5912 [ 105.170698][ C1] [ 105.170710][ C1] CPU: 1 UID: 0 PID: 5912 Comm: kworker/u9:2 Not tainted 6.17.0-rc1-next-20250815-syzkaller-g1357b2649c02-dirty #0 PREEMPT(full) [ 105.170734][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 105.170747][ C1] Workqueue: hci0 hci_cmd_timeout [ 105.170779][ C1] Call Trace: [ 105.170786][ C1] [ 105.170795][ C1] dump_stack_lvl+0x189/0x250 [ 105.170824][ C1] ? __virt_addr_valid+0x1c8/0x5c0 [ 105.170839][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.170867][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 105.170892][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.170913][ C1] ? lock_release+0x4b/0x3e0 [ 105.170931][ C1] ? __virt_addr_valid+0x1c8/0x5c0 [ 105.170944][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 105.170959][ C1] print_report+0xca/0x240 [ 105.170974][ C1] ? usbtmc_interrupt+0x4c7/0x690 [ 105.170993][ C1] kasan_report+0x118/0x150 [ 105.171011][ C1] ? usbtmc_interrupt+0x4c7/0x690 [ 105.171033][ C1] usbtmc_interrupt+0x4c7/0x690 [ 105.171053][ C1] ? usb_unanchor_urb+0xa5/0xc0 [ 105.171071][ C1] ? usb_anchor_suspend_wakeups+0x3b/0x50 [ 105.171091][ C1] __usb_hcd_giveback_urb+0x376/0x540 [ 105.171110][ C1] dummy_timer+0x862/0x4550 [ 105.171125][ C1] ? trace_pelt_se_tp+0x39/0x130 [ 105.171163][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.171179][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.171193][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.171207][ C1] __hrtimer_run_queues+0x529/0xc60 [ 105.171231][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 105.171249][ C1] ? read_tsc+0x9/0x20 [ 105.171265][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 105.171286][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 105.171307][ C1] handle_softirqs+0x283/0x870 [ 105.171326][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 105.171346][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 105.171365][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 105.171387][ C1] __irq_exit_rcu+0xca/0x1f0 [ 105.171405][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 105.171426][ C1] irq_exit_rcu+0x9/0x30 [ 105.171443][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 105.171459][ C1] [ 105.171464][ C1] [ 105.171470][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.171486][ C1] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 105.171510][ C1] Code: 48 21 c3 0f 85 e9 01 00 00 e8 35 43 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 26 43 1f 00 eb 06 e8 1f 43 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 fa c0 82 00 48 8b 1b 48 8b 44 24 [ 105.171524][ C1] RSP: 0018:ffffc90004047500 EFLAGS: 00000293 [ 105.171537][ C1] RAX: 1ffffffff1db912f RBX: ffffffff8edc8978 RCX: ffff88802edc9e00 [ 105.171550][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.171559][ C1] RBP: ffffc90004047650 R08: ffffffff8fe4e137 R09: 1ffffffff1fc9c26 [ 105.171571][ C1] R10: dffffc0000000000 R11: fffffbfff1fc9c27 R12: dffffc0000000000 [ 105.171583][ C1] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8edc8920 [ 105.171600][ C1] ? console_flush_all+0x13a/0xc40 [ 105.171623][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 105.171643][ C1] ? lock_acquire+0x5f/0x360 [ 105.171664][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 105.171681][ C1] console_unlock+0xc4/0x270 [ 105.171700][ C1] ? __pfx_console_unlock+0x10/0x10 [ 105.171720][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 105.171736][ C1] vprintk_emit+0x5b7/0x7a0 [ 105.171756][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 105.171775][ C1] ? __update_load_avg_cfs_rq+0x6f6/0xbd0 [ 105.171797][ C1] ? __pfx___calc_delta+0x10/0x10 [ 105.171811][ C1] ? cpufreq_update_util+0x85/0x290 [ 105.171831][ C1] _printk+0xcf/0x120 [ 105.171853][ C1] ? __pfx__printk+0x10/0x10 [ 105.171879][ C1] ? do_raw_spin_lock+0x121/0x290 [ 105.171903][ C1] bt_err+0x10b/0x160 [ 105.171921][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.171940][ C1] ? __pfx_bt_err+0x10/0x10 [ 105.171958][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 105.171976][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.171994][ C1] ? lock_acquire+0x5f/0x360 [ 105.172012][ C1] hci_cmd_timeout+0xff/0x1e0 [ 105.172033][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 105.172052][ C1] process_scheduled_works+0xade/0x17b0 [ 105.172078][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 105.172102][ C1] worker_thread+0x8a0/0xda0 [ 105.172122][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 105.172140][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 105.172155][ C1] ? __kthread_parkme+0x7b/0x200 [ 105.172177][ C1] kthread+0x70e/0x8a0 [ 105.172191][ C1] ? __pfx_worker_thread+0x10/0x10 [ 105.172209][ C1] ? __pfx_kthread+0x10/0x10 [ 105.172222][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.172240][ C1] ? __pfx_kthread+0x10/0x10 [ 105.172253][ C1] ret_from_fork+0x3f9/0x770 [ 105.172272][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 105.172292][ C1] ? __switch_to_asm+0x39/0x70 [ 105.172306][ C1] ? __switch_to_asm+0x33/0x70 [ 105.172320][ C1] ? __pfx_kthread+0x10/0x10 [ 105.172333][ C1] ret_from_fork_asm+0x1a/0x30 [ 105.172352][ C1] [ 105.172357][ C1] [ 105.172362][ C1] Allocated by task 5979: [ 105.172370][ C1] kasan_save_track+0x3e/0x80 [ 105.172382][ C1] __kasan_kmalloc+0x93/0xb0 [ 105.172395][ C1] __kmalloc_noprof+0x27a/0x4f0 [ 105.172410][ C1] usbtmc_probe+0xa3a/0x1a60 [ 105.172428][ C1] usb_probe_interface+0x665/0xc30 [ 105.172442][ C1] really_probe+0x26d/0x9e0 [ 105.172460][ C1] __driver_probe_device+0x18c/0x2f0 [ 105.172478][ C1] driver_probe_device+0x4f/0x430 [ 105.172496][ C1] __device_attach_driver+0x2ce/0x530 [ 105.172515][ C1] bus_for_each_drv+0x24e/0x2e0 [ 105.172528][ C1] __device_attach+0x2b8/0x400 [ 105.172545][ C1] bus_probe_device+0x185/0x260 [ 105.172558][ C1] device_add+0x7b6/0xb50 [ 105.172573][ C1] usb_set_configuration+0x1a87/0x20e0 [ 105.172594][ C1] usb_generic_driver_probe+0x8d/0x150 [ 105.172615][ C1] usb_probe_device+0x1c4/0x390 [ 105.172627][ C1] really_probe+0x26d/0x9e0 [ 105.172645][ C1] __driver_probe_device+0x18c/0x2f0 [ 105.172663][ C1] driver_probe_device+0x4f/0x430 [ 105.172681][ C1] __device_attach_driver+0x2ce/0x530 [ 105.172699][ C1] bus_for_each_drv+0x24e/0x2e0 [ 105.172713][ C1] __device_attach+0x2b8/0x400 [ 105.172729][ C1] bus_probe_device+0x185/0x260 [ 105.172742][ C1] device_add+0x7b6/0xb50 [ 105.172757][ C1] usb_new_device+0xa39/0x16f0 [ 105.172775][ C1] hub_event+0x2958/0x4a20 [ 105.172794][ C1] process_scheduled_works+0xade/0x17b0 [ 105.172812][ C1] worker_thread+0x8a0/0xda0 [ 105.172829][ C1] kthread+0x70e/0x8a0 [ 105.172840][ C1] ret_from_fork+0x3f9/0x770 [ 105.172862][ C1] ret_from_fork_asm+0x1a/0x30 [ 105.172876][ C1] [ 105.172880][ C1] The buggy address belongs to the object at ffff88801eac7cc0 [ 105.172880][ C1] which belongs to the cache kmalloc-8 of size 8 [ 105.172892][ C1] The buggy address is located 0 bytes to the right of [ 105.172892][ C1] allocated 1-byte region [ffff88801eac7cc0, ffff88801eac7cc1) [ 105.172908][ C1] [ 105.172912][ C1] The buggy address belongs to the physical page: [ 105.172936][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eac7 [ 105.172951][ C1] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 105.172968][ C1] page_type: f5(slab) [ 105.172983][ C1] raw: 00fff00000000000 ffff88801a841500 dead000000000100 dead000000000122 [ 105.172997][ C1] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 105.173006][ C1] page dumped because: kasan: bad access detected [ 105.173017][ C1] page_owner tracks the page as allocated [ 105.173023][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2652454751, free_ts 0 [ 105.173051][ C1] post_alloc_hook+0x240/0x2a0 [ 105.173066][ C1] get_page_from_freelist+0x21e4/0x22c0 [ 105.173084][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 105.173102][ C1] alloc_pages_mpol+0x232/0x4a0 [ 105.173117][ C1] allocate_slab+0x8a/0x370 [ 105.173135][ C1] ___slab_alloc+0xbeb/0x1410 [ 105.173150][ C1] __kmalloc_noprof+0x305/0x4f0 [ 105.173163][ C1] security_sb_alloc+0x48/0x330 [ 105.173182][ C1] alloc_super+0x20c/0x970 [ 105.173196][ C1] sget_fc+0x329/0xa40 [ 105.173209][ C1] get_tree_single+0x2f/0x150 [ 105.173224][ C1] vfs_get_tree+0x8f/0x2b0 [ 105.173240][ C1] vfs_kern_mount+0xbe/0x160 [ 105.173255][ C1] simple_pin_fs+0xe1/0x160 [ 105.173271][ C1] securityfs_create_dentry+0x1bf/0x4d0 [ 105.173290][ C1] securityfs_init+0xae/0xc0 [ 105.173310][ C1] page_owner free stack trace missing [ 105.173315][ C1] [ 105.173319][ C1] Memory state around the buggy address: [ 105.173327][ C1] ffff88801eac7b80: 06 fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc [ 105.173338][ C1] ffff88801eac7c00: 06 fc fc fc 00 fc fc fc 06 fc fc fc 00 fc fc fc [ 105.173349][ C1] >ffff88801eac7c80: 00 fc fc fc 00 fc fc fc 01 fc fc fc 06 fc fc fc [ 105.173358][ C1] ^ [ 105.173367][ C1] ffff88801eac7d00: 00 fc fc fc 06 fc fc fc 00 fc fc fc 00 fc fc fc [ 105.173378][ C1] ffff88801eac7d80: fa fc fc fc 06 fc fc fc fa fc fc fc 06 fc fc fc [ 105.173387][ C1] ================================================================== [ 105.173399][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 105.173409][ C1] CPU: 1 UID: 0 PID: 5912 Comm: kworker/u9:2 Not tainted 6.17.0-rc1-next-20250815-syzkaller-g1357b2649c02-dirty #0 PREEMPT(full) [ 105.173428][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 105.173439][ C1] Workqueue: hci0 hci_cmd_timeout [ 105.173460][ C1] Call Trace: [ 105.173466][ C1] [ 105.173476][ C1] dump_stack_lvl+0x99/0x250 [ 105.173498][ C1] ? __asan_memcpy+0x40/0x70 [ 105.173519][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 105.173540][ C1] ? __pfx__printk+0x10/0x10 [ 105.173564][ C1] vpanic+0x281/0x750 [ 105.173582][ C1] ? __pfx_print_hex_dump+0x10/0x10 [ 105.173609][ C1] ? __pfx_vpanic+0x10/0x10 [ 105.173632][ C1] panic+0xb9/0xc0 [ 105.173650][ C1] ? __pfx_panic+0x10/0x10 [ 105.173669][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 105.173692][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 105.173709][ C1] ? usbtmc_interrupt+0x4c7/0x690 [ 105.173729][ C1] check_panic_on_warn+0x89/0xb0 [ 105.173745][ C1] ? usbtmc_interrupt+0x4c7/0x690 [ 105.173765][ C1] end_report+0x78/0x160 [ 105.173780][ C1] kasan_report+0x129/0x150 [ 105.173797][ C1] ? usbtmc_interrupt+0x4c7/0x690 [ 105.173819][ C1] usbtmc_interrupt+0x4c7/0x690 [ 105.173839][ C1] ? usb_unanchor_urb+0xa5/0xc0 [ 105.173864][ C1] ? usb_anchor_suspend_wakeups+0x3b/0x50 [ 105.173884][ C1] __usb_hcd_giveback_urb+0x376/0x540 [ 105.173902][ C1] dummy_timer+0x862/0x4550 [ 105.173917][ C1] ? trace_pelt_se_tp+0x39/0x130 [ 105.173955][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.173971][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.173986][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.174000][ C1] __hrtimer_run_queues+0x529/0xc60 [ 105.174025][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 105.174043][ C1] ? read_tsc+0x9/0x20 [ 105.174059][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 105.174081][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 105.174101][ C1] handle_softirqs+0x283/0x870 [ 105.174121][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 105.174141][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 105.174161][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 105.174184][ C1] __irq_exit_rcu+0xca/0x1f0 [ 105.174202][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 105.174223][ C1] irq_exit_rcu+0x9/0x30 [ 105.174240][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 105.174256][ C1] [ 105.174262][ C1] [ 105.174268][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.174285][ C1] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 105.174307][ C1] Code: 48 21 c3 0f 85 e9 01 00 00 e8 35 43 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 26 43 1f 00 eb 06 e8 1f 43 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 fa c0 82 00 48 8b 1b 48 8b 44 24 [ 105.174320][ C1] RSP: 0018:ffffc90004047500 EFLAGS: 00000293 [ 105.174334][ C1] RAX: 1ffffffff1db912f RBX: ffffffff8edc8978 RCX: ffff88802edc9e00 [ 105.174346][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.174356][ C1] RBP: ffffc90004047650 R08: ffffffff8fe4e137 R09: 1ffffffff1fc9c26 [ 105.174368][ C1] R10: dffffc0000000000 R11: fffffbfff1fc9c27 R12: dffffc0000000000 [ 105.174380][ C1] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8edc8920 [ 105.174397][ C1] ? console_flush_all+0x13a/0xc40 [ 105.174421][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 105.174442][ C1] ? lock_acquire+0x5f/0x360 [ 105.174460][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 105.174477][ C1] console_unlock+0xc4/0x270 [ 105.174497][ C1] ? __pfx_console_unlock+0x10/0x10 [ 105.174518][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 105.174534][ C1] vprintk_emit+0x5b7/0x7a0 [ 105.174555][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 105.174574][ C1] ? __update_load_avg_cfs_rq+0x6f6/0xbd0 [ 105.174597][ C1] ? __pfx___calc_delta+0x10/0x10 [ 105.174611][ C1] ? cpufreq_update_util+0x85/0x290 [ 105.174631][ C1] _printk+0xcf/0x120 [ 105.174652][ C1] ? __pfx__printk+0x10/0x10 [ 105.174673][ C1] ? do_raw_spin_lock+0x121/0x290 [ 105.174698][ C1] bt_err+0x10b/0x160 [ 105.174715][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.174735][ C1] ? __pfx_bt_err+0x10/0x10 [ 105.174753][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 105.174771][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.174789][ C1] ? lock_acquire+0x5f/0x360 [ 105.174807][ C1] hci_cmd_timeout+0xff/0x1e0 [ 105.174828][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 105.174847][ C1] process_scheduled_works+0xade/0x17b0 [ 105.174878][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 105.174902][ C1] worker_thread+0x8a0/0xda0 [ 105.174922][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 105.174939][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 105.174954][ C1] ? __kthread_parkme+0x7b/0x200 [ 105.174977][ C1] kthread+0x70e/0x8a0 [ 105.174991][ C1] ? __pfx_worker_thread+0x10/0x10 [ 105.175010][ C1] ? __pfx_kthread+0x10/0x10 [ 105.175023][ C1] ? rcu_is_watching+0x15/0xb0 [ 105.175042][ C1] ? __pfx_kthread+0x10/0x10 [ 105.175055][ C1] ret_from_fork+0x3f9/0x770 [ 105.175075][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 105.175095][ C1] ? __switch_to_asm+0x39/0x70 [ 105.175110][ C1] ? __switch_to_asm+0x33/0x70 [ 105.175125][ C1] ? __pfx_kthread+0x10/0x10 [ 105.175138][ C1] ret_from_fork_asm+0x1a/0x30 [ 105.175158][ C1] [ 105.175399][ C1] Kernel Offset: disabled