ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor120954175 <...> Warning: Permanently added '10.128.0.209' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor120954175", ["ci2-upstream-fs/syz-executor120954175"], 0x7ffd2b15f740 /* 10 vars */) = 0 brk(NULL) = 0x555585815000 brk(0x555585815d80) = 0x555585815d80 arch_prctl(ARCH_SET_FS, 0x555585815400) = 0 set_tid_address(0x5555858156d0) = 5599 set_robust_list(0x5555858156e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor120954175", 4096) = 43 getrandom("\x82\xde\x0c\x49\xc4\x09\xce\xf6", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555585815d80 brk(0x555585836d80) = 0x555585836d80 brk(0x555585837000) = 0x555585837000 mprotect(0x7fcbb60d0000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\x87\x64\x29\x83\x41\x85\x0b\x36", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.n32Wzq", 0700) = 0 chmod("./syzkaller.n32Wzq", 0777) = 0 chdir("./syzkaller.n32Wzq") = 0 mkdir("./0", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5600 attached , child_tidptr=0x5555858156d0) = 5600 [pid 5599] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5600] set_robust_list(0x5555858156e0, 24) = 0 [pid 5600] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5600] chdir("./0") = 0 [pid 5600] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5600] setpgid(0, 0) = 0 [pid 5600] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5600] write(3, "1000", 4) = 4 [pid 5600] close(3) = 0 [pid 5600] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5600] write(1, "executing program\n", 18) = 18 executing program [pid 5600] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 5600] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 5600] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 5600] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/uac1_legacy.usb0", 0777) = 0 [pid 5600] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/configs/c.1", 0777) = 0 [pid 5600] symlinkat("./config/usb_gadget/g1/functions/uac1_legacy.usb0", AT_FDCWD, "./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0") = 0 [pid 5600] openat(AT_FDCWD, "./config/usb_gadget/g1/UDC", O_WRONLY) = 3 [pid 5600] write(3, "dummy_udc.0\n", 12) = -1 EBUSY (Device or resource busy) [pid 5600] exit_group(0) = ? [pid 5600] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5600, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555585816790 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 [ 85.640656][ T5600] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 85.641682][ T5600] udc dummy_udc.0: failed to start g1: -19 [ 85.643481][ T5600] UDC core: g1: couldn't find an available UDC or it's busy umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/config", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55558581e7d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55558581e7d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/config") = 0 getdents64(3, 0x555585816790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5604 attached , child_tidptr=0x5555858156d0) = 5604 [pid 5604] set_robust_list(0x5555858156e0, 24 [pid 5599] rt_sigprocmask(SIG_SETMASK, [] [pid 5604] <... set_robust_list resumed>) = 0 [pid 5599] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5604] chdir("./1") = 0 [pid 5604] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5604] setpgid(0, 0) = 0 [pid 5604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5604] write(3, "1000", 4) = 4 [pid 5604] close(3) = 0 [pid 5604] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5604] write(1, "executing program\n", 18) = 18 executing program [pid 5604] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 5604] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 5604] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = -1 EEXIST (File exists) [pid 5604] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/uac1_legacy.usb0", 0777) = -1 EEXIST (File exists) [pid 5604] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/configs/c.1", 0777) = -1 EEXIST (File exists) [pid 5604] symlinkat("./config/usb_gadget/g1/functions/uac1_legacy.usb0", AT_FDCWD, "./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0") = -1 EEXIST (File exists) [pid 5604] openat(AT_FDCWD, "./config/usb_gadget/g1/UDC", O_WRONLY) = 3 [ 85.927616][ T5604] ================================================================== [ 85.927628][ T5604] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190 [ 85.927662][ T5604] Read of size 8 at addr ffff88803b3c2d90 by task syz-executor120/5604 [ 85.927671][ T5604] [ 85.927687][ T5604] CPU: 0 UID: 0 PID: 5604 Comm: syz-executor120 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 85.927703][ T5604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 85.927715][ T5604] Call Trace: [ 85.927719][ T5604] [ 85.927723][ T5604] dump_stack_lvl+0xe8/0x150 [ 85.927739][ T5604] print_address_description+0x55/0x1e0 [ 85.927754][ T5604] ? filp_flush+0x31/0x190 [ 85.927762][ T5604] print_report+0x58/0x70 [ 85.927774][ T5604] kasan_report+0x117/0x150 [ 85.927785][ T5604] ? filp_flush+0x31/0x190 [ 85.927796][ T5604] kasan_check_range+0x264/0x2c0 [ 85.927807][ T5604] filp_flush+0x31/0x190 [ 85.927816][ T5604] filp_close+0x1d/0x40 [ 85.927825][ T5604] gaudio_cleanup+0x54/0xf0 [ 85.927842][ T5604] f_audio_bind+0x4a0/0x630 [ 85.927854][ T5604] ? __pfx_f_audio_bind+0x10/0x10 [ 85.927865][ T5604] ? rcu_is_watching+0x15/0xb0 [ 85.927877][ T5604] ? usb_gadget_set_selfpowered+0xf5/0x260 [ 85.927890][ T5604] usb_add_function+0x290/0x930 [ 85.927899][ T5604] ? check_remote_wakeup_config+0x58/0x1c0 [ 85.927910][ T5604] configfs_composite_bind+0xde0/0x1410 [ 85.927923][ T5604] ? __pfx_configfs_composite_bind+0x10/0x10 [ 85.927933][ T5604] gadget_bind_driver+0x2ca/0x9e0 [ 85.927948][ T5604] ? __pfx_gadget_bind_driver+0x10/0x10 [ 85.927961][ T5604] really_probe+0x254/0xae0 [ 85.927980][ T5604] __driver_probe_device+0x1e8/0x360 [ 85.927993][ T5604] driver_probe_device+0x4f/0x240 [ 85.928006][ T5604] __driver_attach+0x339/0x600 [ 85.928018][ T5604] bus_for_each_dev+0x23e/0x2c0 [ 85.928034][ T5604] ? __pfx___driver_attach+0x10/0x10 [ 85.928045][ T5604] ? __pfx_bus_for_each_dev+0x10/0x10 [ 85.928061][ T5604] ? rt_spin_unlock+0x163/0x200 [ 85.928076][ T5604] bus_add_driver+0x348/0x670 [ 85.928087][ T5604] driver_register+0x23a/0x320 [ 85.928100][ T5604] usb_gadget_register_driver_owner+0xf9/0x270 [ 85.928115][ T5604] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 85.928129][ T5604] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 85.928143][ T5604] configfs_write_iter+0x33a/0x430 [ 85.928155][ T5604] vfs_write+0x61e/0xbb0 [ 85.928168][ T5604] ? __pfx_vfs_write+0x10/0x10 [ 85.928179][ T5604] ? rt_spin_unlock+0x157/0x200 [ 85.928190][ T5604] ? rt_spin_unlock+0x163/0x200 [ 85.928202][ T5604] ksys_write+0x156/0x270 [ 85.928213][ T5604] ? __pfx_ksys_write+0x10/0x10 [ 85.928225][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.928235][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.928245][ T5604] do_syscall_64+0x174/0x580 [ 85.928258][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.928268][ T5604] ? clear_bhb_loop+0x70/0xc0 [ 85.928279][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.928289][ T5604] RIP: 0033:0x7fcbb603cdb9 [ 85.928302][ T5604] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 85.928310][ T5604] RSP: 002b:00007ffd7ecb1ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.928330][ T5604] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fcbb603cdb9 [ 85.928338][ T5604] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 85.928344][ T5604] RBP: 6769666e6f632f2e R08: 0000555585816040 R09: 0000555585816040 [ 85.928351][ T5604] R10: 0000555585816040 R11: 0000000000000246 R12: 00007ffd7ecb1ecc [ 85.928358][ T5604] R13: 00007ffd7ecb1f00 R14: 00007ffd7ecb1ee0 R15: 0000200000000008 [ 85.928368][ T5604] [ 85.928372][ T5604] [ 85.928374][ T5604] Allocated by task 5600: [ 85.928379][ T5604] kasan_save_track+0x3e/0x80 [ 85.928393][ T5604] __kasan_slab_alloc+0x6c/0x80 [ 85.928401][ T5604] kmem_cache_alloc_noprof+0x355/0x650 [ 85.928415][ T5604] alloc_empty_file+0x5b/0x1d0 [ 85.928428][ T5604] path_openat+0x8f/0x3850 [ 85.928438][ T5604] do_file_open+0x23e/0x4a0 [ 85.928448][ T5604] filp_open+0x16d/0x1d0 [ 85.928460][ T5604] gaudio_setup+0x11b/0xf10 [ 85.928471][ T5604] f_audio_bind+0x137/0x630 [ 85.928484][ T5604] usb_add_function+0x290/0x930 [ 85.928492][ T5604] configfs_composite_bind+0xde0/0x1410 [ 85.928501][ T5604] gadget_bind_driver+0x2ca/0x9e0 [ 85.928512][ T5604] really_probe+0x254/0xae0 [ 85.928523][ T5604] __driver_probe_device+0x1e8/0x360 [ 85.928534][ T5604] driver_probe_device+0x4f/0x240 [ 85.928545][ T5604] __driver_attach+0x339/0x600 [ 85.928556][ T5604] bus_for_each_dev+0x23e/0x2c0 [ 85.928569][ T5604] bus_add_driver+0x348/0x670 [ 85.928576][ T5604] driver_register+0x23a/0x320 [ 85.928588][ T5604] usb_gadget_register_driver_owner+0xf9/0x270 [ 85.928600][ T5604] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 85.928612][ T5604] configfs_write_iter+0x33a/0x430 [ 85.928622][ T5604] vfs_write+0x61e/0xbb0 [ 85.928631][ T5604] ksys_write+0x156/0x270 [ 85.928640][ T5604] do_syscall_64+0x174/0x580 [ 85.928652][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.928660][ T5604] [ 85.928662][ T5604] Freed by task 20: [ 85.928667][ T5604] kasan_save_track+0x3e/0x80 [ 85.928680][ T5604] kasan_save_free_info+0x40/0x50 [ 85.928691][ T5604] __kasan_slab_free+0x5c/0x80 [ 85.928699][ T5604] slab_free_after_rcu_debug+0x12a/0x220 [ 85.928710][ T5604] rcu_cpu_kthread+0x950/0x1480 [ 85.928718][ T5604] smpboot_thread_fn+0x57c/0xa80 [ 85.928729][ T5604] kthread+0x388/0x470 [ 85.928741][ T5604] ret_from_fork+0x514/0xb70 [ 85.928753][ T5604] ret_from_fork_asm+0x1a/0x30 [ 85.928766][ T5604] [ 85.928768][ T5604] Last potentially related work creation: [ 85.928772][ T5604] kasan_save_stack+0x3e/0x60 [ 85.928785][ T5604] kasan_record_aux_stack+0xbd/0xd0 [ 85.928795][ T5604] kmem_cache_free+0x513/0x6c0 [ 85.928804][ T5604] task_work_run+0x1d9/0x270 [ 85.928816][ T5604] ptrace_notify+0x27c/0x2b0 [ 85.928826][ T5604] ptrace_report_syscall_exit+0x2d/0x50 [ 85.928840][ T5604] do_syscall_64+0x4f0/0x580 [ 85.928851][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.928860][ T5604] [ 85.928862][ T5604] Second to last potentially related work creation: [ 85.928866][ T5604] kasan_save_stack+0x3e/0x60 [ 85.928879][ T5604] kasan_record_aux_stack+0xbd/0xd0 [ 85.928890][ T5604] task_work_add+0xae/0x420 [ 85.928902][ T5604] __fput_deferred+0x183/0x3e0 [ 85.928910][ T5604] fput_close+0x11f/0x240 [ 85.928917][ T5604] filp_close+0x27/0x40 [ 85.928925][ T5604] gaudio_cleanup+0x54/0xf0 [ 85.928935][ T5604] f_audio_bind+0x4a0/0x630 [ 85.928945][ T5604] usb_add_function+0x290/0x930 [ 85.928953][ T5604] configfs_composite_bind+0xde0/0x1410 [ 85.928962][ T5604] gadget_bind_driver+0x2ca/0x9e0 [ 85.928978][ T5604] really_probe+0x254/0xae0 [ 85.928989][ T5604] __driver_probe_device+0x1e8/0x360 [ 85.929000][ T5604] driver_probe_device+0x4f/0x240 [ 85.929011][ T5604] __driver_attach+0x339/0x600 [ 85.929022][ T5604] bus_for_each_dev+0x23e/0x2c0 [ 85.929035][ T5604] bus_add_driver+0x348/0x670 [ 85.929042][ T5604] driver_register+0x23a/0x320 [ 85.929054][ T5604] usb_gadget_register_driver_owner+0xf9/0x270 [ 85.929066][ T5604] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 85.929078][ T5604] configfs_write_iter+0x33a/0x430 [ 85.929088][ T5604] vfs_write+0x61e/0xbb0 [ 85.929097][ T5604] ksys_write+0x156/0x270 [ 85.929106][ T5604] do_syscall_64+0x174/0x580 [ 85.929117][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.929126][ T5604] [ 85.929128][ T5604] The buggy address belongs to the object at ffff88803b3c2c00 [ 85.929128][ T5604] which belongs to the cache filp of size 408 [ 85.929136][ T5604] The buggy address is located 400 bytes inside of [ 85.929136][ T5604] freed 408-byte region [ffff88803b3c2c00, ffff88803b3c2d98) [ 85.929146][ T5604] [ 85.929149][ T5604] The buggy address belongs to the physical page: [ 85.929168][ T5604] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3b3c2 [ 85.929178][ T5604] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 85.929186][ T5604] flags: 0x80000000000040(head|node=0|zone=1) [ 85.929199][ T5604] page_type: f5(slab) [ 85.929209][ T5604] raw: 0080000000000040 ffff88801b2b98c0 dead000000000100 dead000000000122 [ 85.929217][ T5604] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 85.929226][ T5604] head: 0080000000000040 ffff88801b2b98c0 dead000000000100 dead000000000122 [ 85.929234][ T5604] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 85.929242][ T5604] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 85.929250][ T5604] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 85.929254][ T5604] page dumped because: kasan: bad access detected [ 85.929262][ T5604] page_owner tracks the page as allocated [ 85.929266][ T5604] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4956, tgid 4956 (udevd), ts 30223832065, free_ts 0 [ 85.929284][ T5604] post_alloc_hook+0x1f9/0x250 [ 85.929298][ T5604] get_page_from_freelist+0x262a/0x26a0 [ 85.929308][ T5604] __alloc_frozen_pages_noprof+0x18d/0x380 [ 85.929317][ T5604] allocate_slab+0x79/0x5e0 [ 85.929328][ T5604] refill_objects+0x2d8/0x350 [ 85.929339][ T5604] __pcs_replace_empty_main+0x330/0x690 [ 85.929349][ T5604] kmem_cache_alloc_noprof+0x452/0x650 [ 85.929362][ T5604] alloc_empty_file+0x5b/0x1d0 [ 85.929374][ T5604] path_openat+0x8f/0x3850 [ 85.929384][ T5604] do_file_open+0x23e/0x4a0 [ 85.929393][ T5604] do_sys_openat2+0x115/0x200 [ 85.929406][ T5604] __x64_sys_openat+0x138/0x170 [ 85.929419][ T5604] do_syscall_64+0x174/0x580 [ 85.929430][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.929439][ T5604] page_owner free stack trace missing [ 85.929443][ T5604] [ 85.929445][ T5604] Memory state around the buggy address: [ 85.929449][ T5604] ffff88803b3c2c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 85.929456][ T5604] ffff88803b3c2d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 85.929462][ T5604] >ffff88803b3c2d80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 85.929466][ T5604] ^ [ 85.929471][ T5604] ffff88803b3c2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 85.929479][ T5604] ffff88803b3c2e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 85.929484][ T5604] ================================================================== [ 85.929829][ T5604] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 85.929840][ T5604] CPU: 0 UID: 0 PID: 5604 Comm: syz-executor120 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 85.929853][ T5604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 85.929858][ T5604] Call Trace: [ 85.929862][ T5604] [ 85.929867][ T5604] vpanic+0x56c/0xa60 [ 85.929884][ T5604] ? rcu_is_watching+0x15/0xb0 [ 85.929895][ T5604] ? __pfx_vpanic+0x10/0x10 [ 85.929918][ T5604] panic+0xc5/0xd0 [ 85.929940][ T5604] ? __pfx_panic+0x10/0x10 [ 85.929963][ T5604] ? preempt_schedule_thunk+0x16/0x40 [ 85.929992][ T5604] ? filp_flush+0x31/0x190 [ 85.930006][ T5604] ? preempt_schedule_thunk+0x16/0x40 [ 85.930024][ T5604] ? filp_flush+0x31/0x190 [ 85.930038][ T5604] check_panic_on_warn+0x89/0xb0 [ 85.930063][ T5604] ? filp_flush+0x31/0x190 [ 85.930078][ T5604] end_report+0x73/0x170 [ 85.930096][ T5604] ? filp_flush+0x31/0x190 [ 85.930111][ T5604] kasan_report+0x128/0x150 [ 85.930131][ T5604] ? filp_flush+0x31/0x190 [ 85.930149][ T5604] kasan_check_range+0x264/0x2c0 [ 85.930169][ T5604] filp_flush+0x31/0x190 [ 85.930184][ T5604] filp_close+0x1d/0x40 [ 85.930193][ T5604] gaudio_cleanup+0x54/0xf0 [ 85.930206][ T5604] f_audio_bind+0x4a0/0x630 [ 85.930217][ T5604] ? __pfx_f_audio_bind+0x10/0x10 [ 85.930229][ T5604] ? rcu_is_watching+0x15/0xb0 [ 85.930240][ T5604] ? usb_gadget_set_selfpowered+0xf5/0x260 [ 85.930253][ T5604] usb_add_function+0x290/0x930 [ 85.930262][ T5604] ? check_remote_wakeup_config+0x58/0x1c0 [ 85.930273][ T5604] configfs_composite_bind+0xde0/0x1410 [ 85.930285][ T5604] ? __pfx_configfs_composite_bind+0x10/0x10 [ 85.930295][ T5604] gadget_bind_driver+0x2ca/0x9e0 [ 85.930311][ T5604] ? __pfx_gadget_bind_driver+0x10/0x10 [ 85.930324][ T5604] really_probe+0x254/0xae0 [ 85.930337][ T5604] __driver_probe_device+0x1e8/0x360 [ 85.930350][ T5604] driver_probe_device+0x4f/0x240 [ 85.930363][ T5604] __driver_attach+0x339/0x600 [ 85.930375][ T5604] bus_for_each_dev+0x23e/0x2c0 [ 85.930390][ T5604] ? __pfx___driver_attach+0x10/0x10 [ 85.930402][ T5604] ? __pfx_bus_for_each_dev+0x10/0x10 [ 85.930418][ T5604] ? rt_spin_unlock+0x163/0x200 [ 85.930430][ T5604] bus_add_driver+0x348/0x670 [ 85.930441][ T5604] driver_register+0x23a/0x320 [ 85.930454][ T5604] usb_gadget_register_driver_owner+0xf9/0x270 [ 85.930468][ T5604] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 85.930486][ T5604] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 85.930500][ T5604] configfs_write_iter+0x33a/0x430 [ 85.930512][ T5604] vfs_write+0x61e/0xbb0 [ 85.930524][ T5604] ? __pfx_vfs_write+0x10/0x10 [ 85.930535][ T5604] ? rt_spin_unlock+0x157/0x200 [ 85.930546][ T5604] ? rt_spin_unlock+0x163/0x200 [ 85.930558][ T5604] ksys_write+0x156/0x270 [ 85.930569][ T5604] ? __pfx_ksys_write+0x10/0x10 [ 85.930581][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.930591][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.930601][ T5604] do_syscall_64+0x174/0x580 [ 85.930615][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.930624][ T5604] ? clear_bhb_loop+0x70/0xc0 [ 85.930635][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.930646][ T5604] RIP: 0033:0x7fcbb603cdb9 [ 85.930655][ T5604] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 85.930664][ T5604] RSP: 002b:00007ffd7ecb1ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.930675][ T5604] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fcbb603cdb9 [ 85.930683][ T5604] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 85.930689][ T5604] RBP: 6769666e6f632f2e R08: 0000555585816040 R09: 0000555585816040 [ 85.930696][ T5604] R10: 0000555585816040 R11: 0000000000000246 R12: 00007ffd7ecb1ecc [ 85.930703][ T5604] R13: 00007ffd7ecb1f00 R14: 00007ffd7ecb1ee0 R15: 0000200000000008 [ 85.930713][ T5604] [ 85.930868][ T5604] Kernel Offset: disabled