no interfaces have a carrier [ 39.556080][ T3854] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.572291][ T3854] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.176' (ED25519) to the list of known hosts. executing program executing program executing program executing program executing program syzkaller login: [ 67.564825][ T1108] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 67.574944][ T2303] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 67.584794][ T3158] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 67.592435][ T3520] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 67.600055][ T21] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 67.804777][ T1108] usb 1-1: Using ep0 maxpacket: 8 [ 67.814948][ T2303] usb 4-1: Using ep0 maxpacket: 8 [ 67.844819][ T3158] usb 3-1: Using ep0 maxpacket: 8 [ 67.850003][ T21] usb 2-1: Using ep0 maxpacket: 8 [ 67.855189][ T3520] usb 5-1: Using ep0 maxpacket: 8 [ 67.965050][ T1108] usb 1-1: unable to get BOS descriptor or descriptor too short [ 67.974852][ T2303] usb 4-1: unable to get BOS descriptor or descriptor too short [ 68.044993][ T1108] usb 1-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 68.055570][ T3158] usb 3-1: unable to get BOS descriptor or descriptor too short [ 68.055602][ T2303] usb 4-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 68.063583][ T21] usb 2-1: unable to get BOS descriptor or descriptor too short [ 68.073296][ T1108] usb 1-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 68.081086][ T3520] usb 5-1: unable to get BOS descriptor or descriptor too short [ 68.091187][ T2303] usb 4-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 68.108162][ T1108] usb 1-1: config 8 interface 0 has no altsetting 0 [ 68.115098][ T2303] usb 4-1: config 8 interface 0 has no altsetting 0 [ 68.204953][ T3158] usb 3-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 68.214921][ T21] usb 2-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 68.224655][ T21] usb 2-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 68.234725][ T3520] usb 5-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 68.244481][ T3520] usb 5-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 68.254408][ T3158] usb 3-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 68.264210][ T3158] usb 3-1: config 8 interface 0 has no altsetting 0 [ 68.270904][ T21] usb 2-1: config 8 interface 0 has no altsetting 0 [ 68.277677][ T3520] usb 5-1: config 8 interface 0 has no altsetting 0 [ 68.295254][ T1108] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 68.304503][ T2303] usb 4-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 68.313575][ T1108] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.322296][ T2303] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.330455][ T1108] usb 1-1: Product: syz [ 68.334635][ T1108] usb 1-1: Manufacturer: syz [ 68.339298][ T2303] usb 4-1: Product: syz [ 68.343497][ T2303] usb 4-1: Manufacturer: syz [ 68.348154][ T1108] usb 1-1: SerialNumber: syz [ 68.354003][ T2303] usb 4-1: SerialNumber: syz [ 68.434999][ T3158] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 68.444255][ T21] usb 2-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 68.453423][ T3520] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 68.462544][ T3158] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.470648][ T21] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.478725][ T3520] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.486790][ T3158] usb 3-1: Product: syz [ 68.490976][ T3158] usb 3-1: Manufacturer: syz [ 68.495635][ T21] usb 2-1: Product: syz [ 68.499810][ T21] usb 2-1: Manufacturer: syz [ 68.504408][ T21] usb 2-1: SerialNumber: syz [ 68.509079][ T3520] usb 5-1: Product: syz [ 68.513253][ T3520] usb 5-1: Manufacturer: syz [ 68.517936][ T3158] usb 3-1: SerialNumber: syz [ 68.523073][ T3520] usb 5-1: SerialNumber: syz executing program executing program [ 68.690186][ T2303] usb 4-1: selecting invalid altsetting 0 [ 68.722149][ T1108] usb 1-1: selecting invalid altsetting 0 [ 68.728018][ T2303] snd-usb-audio: probe of 4-1:8.0 failed with error -12 executing program executing program executing program [ 68.753825][ T2303] usb 4-1: USB disconnect, device number 2 [ 68.776658][ T1108] snd-usb-audio: probe of 1-1:8.0 failed with error -12 [ 68.806309][ T1108] usb 1-1: USB disconnect, device number 2 [ 68.857193][ T3520] usb 5-1: selecting invalid altsetting 0 [ 68.881125][ T3158] usb 3-1: selecting invalid altsetting 0 [ 68.887519][ T3520] snd-usb-audio: probe of 5-1:8.0 failed with error -12 [ 68.907437][ T3520] usb 5-1: USB disconnect, device number 2 [ 68.921133][ T21] usb 2-1: selecting invalid altsetting 0 [ 68.927063][ T3158] snd-usb-audio: probe of 3-1:8.0 failed with error -12 [ 68.949014][ T3158] usb 3-1: USB disconnect, device number 2 [ 68.988371][ T21] snd-usb-audio: probe of 2-1:8.0 failed with error -12 [ 69.003380][ T21] usb 2-1: USB disconnect, device number 2 [ 69.144840][ T2303] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 69.164927][ T1108] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 69.294856][ T3520] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 69.334917][ T3158] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 69.384795][ T21] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 69.404820][ T2303] usb 4-1: Using ep0 maxpacket: 8 [ 69.434886][ T1108] usb 1-1: Using ep0 maxpacket: 8 [ 69.544845][ T3520] usb 5-1: Using ep0 maxpacket: 8 [ 69.574769][ T3158] usb 3-1: Using ep0 maxpacket: 8 [ 69.585115][ T2303] usb 4-1: unable to get BOS descriptor or descriptor too short [ 69.615019][ T1108] usb 1-1: unable to get BOS descriptor or descriptor too short [ 69.624954][ T21] usb 2-1: Using ep0 maxpacket: 8 [ 69.705179][ T3520] usb 5-1: unable to get BOS descriptor or descriptor too short [ 69.705438][ T2303] usb 4-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 69.722800][ T2303] usb 4-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 69.732713][ T1108] usb 1-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 69.734875][ T3158] usb 3-1: unable to get BOS descriptor or descriptor too short [ 69.742716][ T2303] usb 4-1: config 8 interface 0 has no altsetting 0 [ 69.757041][ T1108] usb 1-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 69.766829][ T1108] usb 1-1: config 8 interface 0 has no altsetting 0 [ 69.784928][ T21] usb 2-1: unable to get BOS descriptor or descriptor too short [ 69.792793][ T3520] usb 5-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 69.802918][ T3520] usb 5-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 69.812718][ T3520] usb 5-1: config 8 interface 0 has no altsetting 0 [ 69.835044][ T3158] usb 3-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 69.844992][ T3158] usb 3-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 69.854934][ T3158] usb 3-1: config 8 interface 0 has no altsetting 0 [ 69.884989][ T21] usb 2-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 69.895275][ T21] usb 2-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 69.905202][ T21] usb 2-1: config 8 interface 0 has no altsetting 0 [ 69.974918][ T2303] usb 4-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 69.974922][ T3520] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 69.974950][ T3520] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.984589][ T1108] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 69.994060][ T3520] usb 5-1: Product: syz [ 70.001827][ T2303] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.010843][ T3520] usb 5-1: Manufacturer: syz [ 70.015149][ T1108] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.026816][ T3158] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 70.028265][ T2303] usb 4-1: Product: syz [ 70.038673][ T3520] usb 5-1: SerialNumber: syz [ 70.049355][ T1108] usb 1-1: Product: syz [ 70.055041][ T3158] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.057806][ T2303] usb 4-1: Manufacturer: syz [ 70.068133][ T3158] usb 3-1: Product: syz [ 70.070389][ T1108] usb 1-1: Manufacturer: syz [ 70.073944][ T3158] usb 3-1: Manufacturer: syz [ 70.078971][ T1108] usb 1-1: SerialNumber: syz [ 70.083400][ T21] usb 2-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 70.088402][ T2303] usb 4-1: SerialNumber: syz [ 70.099267][ T21] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.109724][ T3158] usb 3-1: SerialNumber: syz [ 70.117266][ T21] usb 2-1: Product: syz [ 70.122371][ T21] usb 2-1: Manufacturer: syz [ 70.127740][ T21] usb 2-1: SerialNumber: syz executing program executing program executing program executing program executing program [ 70.416630][ T3520] usb 5-1: selecting invalid altsetting 0 [ 70.439277][ T3520] snd-usb-audio: probe of 5-1:8.0 failed with error -12 [ 70.439733][ T2303] usb 4-1: selecting invalid altsetting 0 [ 70.457855][ T3520] usb 5-1: USB disconnect, device number 3 [ 70.475845][ T1108] usb 1-1: selecting invalid altsetting 0 [ 70.482908][ T2303] snd-usb-audio: probe of 4-1:8.0 failed with error -12 [ 70.499614][ T2303] usb 4-1: USB disconnect, device number 3 [ 70.512799][ T1108] snd-usb-audio: probe of 1-1:8.0 failed with error -12 [ 70.513383][ T3158] usb 3-1: selecting invalid altsetting 0 [ 70.524879][ T1108] usb 1-1: USB disconnect, device number 3 [ 70.546806][ T21] usb 2-1: selecting invalid altsetting 0 [ 70.553906][ T3158] snd-usb-audio: probe of 3-1:8.0 failed with error -12 [ 70.569486][ T3158] usb 3-1: USB disconnect, device number 3 [ 70.583071][ T21] snd-usb-audio: probe of 2-1:8.0 failed with error -12 [ 70.595312][ T21] usb 2-1: USB disconnect, device number 3 [ 70.824830][ T3520] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 70.924801][ T2303] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 70.932592][ T1108] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 70.944833][ T3158] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 70.952565][ T21] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 71.074829][ T3520] usb 5-1: Using ep0 maxpacket: 8 [ 71.195068][ T3158] usb 3-1: Using ep0 maxpacket: 8 [ 71.200426][ T21] usb 2-1: Using ep0 maxpacket: 8 [ 71.215155][ T2303] usb 4-1: Using ep0 maxpacket: 8 [ 71.220405][ T1108] usb 1-1: Using ep0 maxpacket: 8 [ 71.235068][ T3520] usb 5-1: unable to get BOS descriptor or descriptor too short [ 71.314989][ T3520] usb 5-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 71.325244][ T3520] usb 5-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 71.335273][ T3520] usb 5-1: config 8 interface 0 has no altsetting 0 [ 71.364945][ T3158] usb 3-1: unable to get BOS descriptor or descriptor too short [ 71.372802][ T21] usb 2-1: unable to get BOS descriptor or descriptor too short [ 71.437684][ T2303] usb 4-1: unable to get BOS descriptor or descriptor too short [ 71.445043][ T3158] usb 3-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 71.445678][ T1108] usb 1-1: unable to get BOS descriptor or descriptor too short [ 71.455764][ T21] usb 2-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 71.472744][ T3158] usb 3-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 71.482730][ T3158] usb 3-1: config 8 interface 0 has no altsetting 0 [ 71.489535][ T21] usb 2-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 71.499494][ T3520] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 71.508677][ T3520] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.516738][ T21] usb 2-1: config 8 interface 0 has no altsetting 0 [ 71.523439][ T3520] usb 5-1: Product: syz [ 71.527809][ T3520] usb 5-1: Manufacturer: syz [ 71.532439][ T3520] usb 5-1: SerialNumber: syz [ 71.544929][ T2303] usb 4-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 71.555221][ T1108] usb 1-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 71.565080][ T2303] usb 4-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 71.575431][ T1108] usb 1-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 71.585245][ T2303] usb 4-1: config 8 interface 0 has no altsetting 0 [ 71.591977][ T1108] usb 1-1: config 8 interface 0 has no altsetting 0 [ 71.664932][ T3158] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 71.674254][ T3158] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.682630][ T21] usb 2-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 71.691802][ T3158] usb 3-1: Product: syz [ 71.696068][ T3158] usb 3-1: Manufacturer: syz [ 71.700676][ T3158] usb 3-1: SerialNumber: syz [ 71.705334][ T21] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.713355][ T21] usb 2-1: Product: syz [ 71.718267][ T21] usb 2-1: Manufacturer: syz [ 71.722877][ T21] usb 2-1: SerialNumber: syz executing program [ 71.785020][ T2303] usb 4-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 71.794273][ T1108] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 71.803362][ T2303] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.811541][ T1108] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.819595][ T2303] usb 4-1: Product: syz [ 71.823809][ T2303] usb 4-1: Manufacturer: syz [ 71.828480][ T1108] usb 1-1: Product: syz [ 71.832653][ T1108] usb 1-1: Manufacturer: syz [ 71.837291][ T2303] usb 4-1: SerialNumber: syz [ 71.842443][ T1108] usb 1-1: SerialNumber: syz [ 71.856808][ T3520] usb 5-1: selecting invalid altsetting 0 [ 71.879849][ T3520] snd-usb-audio: probe of 5-1:8.0 failed with error -12 [ 71.889025][ T3520] usb 5-1: USB disconnect, device number 4 executing program executing program [ 72.046906][ T21] usb 2-1: selecting invalid altsetting 0 [ 72.071728][ T3158] usb 3-1: selecting invalid altsetting 0 [ 72.077545][ T21] snd-usb-audio: probe of 2-1:8.0 failed with error -12 executing program executing program [ 72.093832][ T21] usb 2-1: USB disconnect, device number 4 [ 72.120086][ T3158] ------------[ cut here ]------------ [ 72.125722][ T3158] ODEBUG: free active (active state 0) object type: timer_list hint: snd_usbmidi_error_timer+0x0/0x660 [ 72.137380][ T3158] WARNING: CPU: 1 PID: 3158 at lib/debugobjects.c:521 debug_check_no_obj_freed+0x43c/0x530 [ 72.148009][ T3158] Modules linked in: [ 72.151935][ T3158] CPU: 1 PID: 3158 Comm: kworker/1:2 Not tainted syzkaller #0 [ 72.159737][ T3158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 72.170205][ T3158] Workqueue: usb_hub_wq hub_event [ 72.175562][ T3158] RIP: 0010:debug_check_no_obj_freed+0x43c/0x530 [ 72.181937][ T3158] Code: ef e8 c8 fd dc fd 4c 8b 45 00 48 c7 c7 20 f1 59 8a 48 c7 c6 e0 ed 59 8a 48 c7 c2 80 f2 59 8a 8b 0c 24 4d 89 e9 e8 e4 f0 b7 05 <0f> 0b 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc ff df ff 05 45 32 8a [ 72.202678][ T3158] RSP: 0018:ffffc9000cc5ea18 EFLAGS: 00010246 [ 72.209043][ T3158] RAX: 3169d7639c632100 RBX: ffffffff96307758 RCX: ffff88802a6ebb80 [ 72.217122][ T3158] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 72.225115][ C0] ================================================================== [ 72.225195][ C0] BUG: KASAN: use-after-free in snd_usbmidi_error_timer+0x5fe/0x660 [ 72.233327][ T3158] RBP: ffffffff8a0c9cc0 R08: dffffc0000000000 R09: fffff5200198bca9 [ 72.233349][ T3158] R10: fffff5200198bca9 R11: 1ffff9200198bca8 R12: ffff8880741c0c00 [ 72.241397][ C0] Read of size 1 at addr ffff8880203eed43 by task swapper/0/0 [ 72.241418][ C0] [ 72.241425][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 72.241444][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 72.241457][ C0] Call Trace: [ 72.241465][ C0] [ 72.241473][ C0] dump_stack_lvl+0x168/0x230 [ 72.249568][ T3520] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 72.257451][ C0] ? show_regs_print_info+0x20/0x20 [ 72.257482][ C0] ? load_image+0x3b0/0x3b0 [ 72.257501][ C0] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 72.265280][ T3158] R13: ffffffff87bc58f0 R14: ffff8880741c0000 R15: ffff8880741c0840 [ 72.267349][ C0] print_address_description+0x60/0x2d0 [ 72.274461][ T3158] FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 72.284552][ C0] ? snd_usbmidi_error_timer+0x5fe/0x660 [ 72.284587][ C0] kasan_report+0xdf/0x130 [ 72.284613][ C0] ? snd_usbmidi_error_timer+0x5fe/0x660 [ 72.284639][ C0] snd_usbmidi_error_timer+0x5fe/0x660 [ 72.288423][ T3158] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.290784][ C0] ? __snd_usbmidi_create+0x2f90/0x2f90 [ 72.295526][ T3158] CR2: 00005555648e0ca8 CR3: 000000007a5aa000 CR4: 00000000003506e0 [ 72.302904][ C0] call_timer_fn+0x16c/0x530 [ 72.308426][ T3158] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 72.312606][ C0] ? __snd_usbmidi_create+0x2f90/0x2f90 [ 72.318460][ T3158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 72.325950][ C0] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 72.325985][ C0] ? __run_timers+0x7c0/0x7c0 [ 72.326014][ C0] ? rcu_is_watching+0x11/0xa0 [ 72.326034][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 72.326055][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 72.326077][ C0] ? __snd_usbmidi_create+0x2f90/0x2f90 [ 72.331994][ T3158] Call Trace: [ 72.340584][ C0] __run_timers+0x525/0x7c0 [ 72.340626][ C0] ? detach_timer+0x2b0/0x2b0 [ 72.340646][ C0] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 72.346340][ T3158] [ 72.350694][ C0] ? sched_clock_cpu+0x15/0x3c0 [ 72.356380][ T3158] slab_free_freelist_hook+0x8b/0x170 [ 72.361766][ C0] ? ktime_get_real_ts64+0x420/0x420 [ 72.368389][ T3158] ? snd_rawmidi_free+0x3b7/0x3e0 [ 72.373905][ C0] run_timer_softirq+0x63/0xf0 [ 72.381917][ T3158] kfree+0xef/0x2a0 [ 72.386447][ C0] handle_softirqs+0x328/0x820 [ 72.386477][ C0] ? __irq_exit_rcu+0x12f/0x220 [ 72.394453][ T3158] ? ch345_broken_sysex_input+0x490/0x490 [ 72.400009][ C0] ? do_softirq+0x200/0x200 [ 72.400044][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 72.400070][ C0] __irq_exit_rcu+0x12f/0x220 [ 72.400090][ C0] ? irq_exit_rcu+0x20/0x20 [ 72.400120][ C0] irq_exit_rcu+0x5/0x20 [ 72.408928][ T3158] snd_rawmidi_free+0x3b7/0x3e0 [ 72.414262][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 72.419061][ T3158] snd_rawmidi_dev_free+0x34/0x40 [ 72.423743][ C0] [ 72.428995][ T3158] __snd_device_free+0x1cd/0x2e0 [ 72.434143][ C0] [ 72.439841][ T3158] snd_device_free_all+0xcb/0x180 [ 72.443079][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 72.447632][ T3158] ? snd_mixer_oss_ioctl1+0x1590/0x1590 [ 72.452270][ C0] RIP: 0010:default_idle+0xb/0x10 [ 72.458310][ T3158] release_card_device+0x6d/0x1f0 [ 72.461172][ C0] Code: bf 48 89 df e8 c6 03 11 f8 eb b5 e8 ef b5 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 00 cc 66 90 0f 00 2d 17 93 5a 00 fb f4 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48 [ 72.466095][ T3158] ? snd_power_wait+0x80/0x80 [ 72.471415][ C0] RSP: 0018:ffffffff8be07dc8 EFLAGS: 000002c6 [ 72.476932][ T21] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 72.481796][ C0] [ 72.481804][ C0] RAX: 80c42dcc23f1ab00 RBX: ffffffff8bebc480 RCX: 80c42dcc23f1ab00 [ 72.486737][ T3158] device_release+0x92/0x1c0 [ 72.490360][ C0] RDX: 0000000000000001 RSI: ffffffff8a0b1be0 RDI: ffffffff8a59e800 [ 72.495259][ T3158] kobject_put+0x21d/0x460 [ 72.499963][ C0] RBP: ffffffff8be07ef8 R08: dffffc0000000000 R09: ffffed1017207662 [ 72.505887][ T3158] snd_card_free+0x123/0x190 [ 72.510189][ C0] R10: ffffed1017207662 R11: 1ffff11017207661 R12: ffffffff8d6935a8 [ 72.515533][ T3158] ? snd_card_free_on_error+0x1d0/0x1d0 [ 72.520060][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff17d7890 [ 72.524578][ T3158] usb_audio_probe+0x187f/0x1d50 [ 72.528808][ C0] default_idle_call+0x81/0xc0 [ 72.528833][ C0] do_idle+0x21b/0x5b0 [ 72.533743][ T3158] ? snd_usb_autosuspend+0x1b0/0x1b0 [ 72.539354][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 72.539382][ C0] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 72.539416][ C0] cpu_startup_entry+0x14/0x20 [ 72.544480][ T3520] usb 5-1: Using ep0 maxpacket: 8 [ 72.547386][ C0] ? time_init+0x40/0x40 [ 72.547412][ C0] start_kernel+0x486/0x530 [ 72.552368][ T3158] ? pm_runtime_enable+0x1be/0x300 [ 72.555297][ C0] secondary_startup_64_no_verify+0xb1/0xbb [ 72.555341][ C0] [ 72.555350][ C0] [ 72.555357][ C0] Allocated by task 3158: [ 72.560372][ T3158] usb_probe_interface+0x5a0/0xaf0 [ 72.566336][ C0] __kasan_kmalloc+0xb5/0xf0 [ 72.566359][ C0] snd_usbmidi_in_endpoint_create+0x7e/0xa20 [ 72.566381][ C0] __snd_usbmidi_create+0x16f8/0x2f90 [ 72.572136][ T3158] ? usb_register_driver+0x3d0/0x3d0 [ 72.577019][ C0] create_composite_quirk+0x1ec/0x4e0 [ 72.577041][ C0] usb_audio_probe+0xb72/0x1d50 [ 72.577062][ C0] usb_probe_interface+0x5a0/0xaf0 [ 72.577081][ C0] really_probe+0x284/0xc80 [ 72.582096][ T3158] really_probe+0x284/0xc80 [ 72.601707][ C0] __driver_probe_device+0x18c/0x330 [ 72.601731][ C0] driver_probe_device+0x4f/0x420 [ 72.601749][ C0] __device_attach_driver+0x2b0/0x500 [ 72.601767][ C0] bus_for_each_drv+0x175/0x200 [ 72.601783][ C0] __device_attach+0x29b/0x460 [ 72.601799][ C0] bus_probe_device+0xbc/0x1e0 [ 72.601814][ C0] device_add+0xa00/0xfb0 [ 72.601833][ C0] usb_set_configuration+0x1991/0x1fd0 [ 72.601854][ C0] usb_generic_driver_probe+0x89/0x150 [ 72.601873][ C0] usb_probe_device+0x139/0x270 [ 72.606825][ T3158] __driver_probe_device+0x18c/0x330 [ 72.612625][ C0] really_probe+0x284/0xc80 [ 72.620724][ T3158] driver_probe_device+0x4f/0x420 [ 72.622538][ C0] __driver_probe_device+0x18c/0x330 [ 72.630604][ T3158] __device_attach_driver+0x2b0/0x500 [ 72.635145][ C0] driver_probe_device+0x4f/0x420 [ 72.635169][ C0] __device_attach_driver+0x2b0/0x500 [ 72.635188][ C0] bus_for_each_drv+0x175/0x200 [ 72.635204][ C0] __device_attach+0x29b/0x460 [ 72.635220][ C0] bus_probe_device+0xbc/0x1e0 [ 72.635235][ C0] device_add+0xa00/0xfb0 [ 72.635253][ C0] usb_new_device+0xd53/0x1640 [ 72.635281][ C0] hub_event+0x2dd9/0x5560 [ 72.635298][ C0] process_one_work+0x863/0x1000 [ 72.643442][ T3158] ? deferred_probe_work_func+0x230/0x230 [ 72.647688][ C0] worker_thread+0xdca/0x12a0 [ 72.647710][ C0] kthread+0x436/0x520 [ 72.647727][ C0] ret_from_fork+0x1f/0x30 [ 72.656791][ T3158] bus_for_each_drv+0x175/0x200 [ 72.660305][ C0] [ 72.660313][ C0] Freed by task 3158: [ 72.668364][ T3158] ? _raw_spin_unlock+0x40/0x40 [ 72.673852][ C0] kasan_set_track+0x4b/0x70 [ 72.682242][ T3158] ? subsys_find_device_by_id+0x350/0x350 [ 72.686838][ C0] kasan_set_free_info+0x1f/0x40 [ 72.686870][ C0] ____kasan_slab_free+0xd5/0x110 [ 72.686890][ C0] slab_free_freelist_hook+0xea/0x170 [ 72.691673][ T3158] __device_attach+0x29b/0x460 [ 72.695727][ C0] kfree+0xef/0x2a0 [ 72.695746][ C0] snd_usbmidi_rawmidi_free+0xaa/0x150 [ 72.695767][ C0] snd_rawmidi_free+0x3b7/0x3e0 [ 72.695785][ C0] snd_rawmidi_dev_free+0x34/0x40 [ 72.695803][ C0] __snd_device_free+0x1cd/0x2e0 [ 72.695821][ C0] snd_device_free_all+0xcb/0x180 [ 72.695838][ C0] release_card_device+0x6d/0x1f0 [ 72.695853][ C0] device_release+0x92/0x1c0 [ 72.695868][ C0] kobject_put+0x21d/0x460 [ 72.695885][ C0] snd_card_free+0x123/0x190 [ 72.701403][ T3158] ? kobject_uevent_env+0x371/0x890 [ 72.706356][ C0] usb_audio_probe+0x187f/0x1d50 [ 72.706380][ C0] usb_probe_interface+0x5a0/0xaf0 [ 72.706401][ C0] really_probe+0x284/0xc80 [ 72.712296][ T3158] ? device_attach+0x20/0x20 [ 72.717093][ C0] __driver_probe_device+0x18c/0x330 [ 72.717114][ C0] driver_probe_device+0x4f/0x420 [ 72.717132][ C0] __device_attach_driver+0x2b0/0x500 [ 72.717150][ C0] bus_for_each_drv+0x175/0x200 [ 72.717166][ C0] __device_attach+0x29b/0x460 [ 72.717182][ C0] bus_probe_device+0xbc/0x1e0 [ 72.717198][ C0] device_add+0xa00/0xfb0 [ 72.717216][ C0] usb_set_configuration+0x1991/0x1fd0 [ 72.717236][ C0] usb_generic_driver_probe+0x89/0x150 [ 72.717255][ C0] usb_probe_device+0x139/0x270 [ 72.722466][ T3158] ? kobject_uevent_env+0x371/0x890 [ 72.726536][ C0] really_probe+0x284/0xc80 [ 72.726558][ C0] __driver_probe_device+0x18c/0x330 [ 72.726577][ C0] driver_probe_device+0x4f/0x420 [ 72.731092][ T3158] bus_probe_device+0xbc/0x1e0 [ 72.736191][ C0] __device_attach_driver+0x2b0/0x500 [ 72.736213][ C0] bus_for_each_drv+0x175/0x200 [ 72.736231][ C0] __device_attach+0x29b/0x460 [ 72.736248][ C0] bus_probe_device+0xbc/0x1e0 [ 72.736264][ C0] device_add+0xa00/0xfb0 [ 72.736283][ C0] usb_new_device+0xd53/0x1640 [ 72.736303][ C0] hub_event+0x2dd9/0x5560 [ 72.736319][ C0] process_one_work+0x863/0x1000 [ 72.736339][ C0] worker_thread+0xdca/0x12a0 [ 72.742390][ T3520] usb 5-1: unable to get BOS descriptor or descriptor too short [ 72.745255][ C0] kthread+0x436/0x520 [ 72.745275][ C0] ret_from_fork+0x1f/0x30 [ 72.745297][ C0] [ 72.745303][ C0] The buggy address belongs to the object at ffff8880203eec00 [ 72.745303][ C0] which belongs to the cache kmalloc-512 of size 512 [ 72.747766][ T3158] ? device_add+0x97c/0xfb0 [ 72.751953][ C0] The buggy address is located 323 bytes inside of [ 72.751953][ C0] 512-byte region [ffff8880203eec00, ffff8880203eee00) [ 72.757146][ T3158] device_add+0xa00/0xfb0 [ 72.761645][ C0] The buggy address belongs to the page: [ 72.761672][ C0] page:ffffea000080fb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x203ec [ 72.767949][ T3158] usb_set_configuration+0x1991/0x1fd0 [ 72.773001][ C0] head:ffffea000080fb00 order:2 compound_mapcount:0 compound_pincount:0 [ 72.778500][ T3158] usb_generic_driver_probe+0x89/0x150 [ 72.783662][ C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 72.788963][ T3158] usb_probe_device+0x139/0x270 [ 72.793668][ C0] raw: 00fff00000010200 ffffea000096a300 0000000500000005 ffff888016841c80 [ 72.798267][ T3158] ? usb_register_device_driver+0x230/0x230 [ 72.802695][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 72.808252][ T3158] really_probe+0x284/0xc80 [ 72.812996][ C0] page dumped because: kasan: bad access detected [ 72.818457][ T3158] __driver_probe_device+0x18c/0x330 [ 72.823222][ C0] page_owner tracks the page as allocated [ 72.828297][ T3520] usb 5-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 72.832725][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 8880872619, free_ts 0 [ 72.837168][ T3158] driver_probe_device+0x4f/0x420 [ 72.842515][ C0] get_page_from_freelist+0x1b77/0x1c60 [ 72.848037][ T3520] usb 5-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 72.852822][ C0] __alloc_pages+0x1e1/0x470 [ 72.858211][ T3158] __device_attach_driver+0x2b0/0x500 [ 72.862611][ C0] alloc_page_interleave+0x24/0x1e0 [ 72.867723][ T3520] usb 5-1: config 8 interface 0 has no altsetting 0 [ 72.872922][ C0] new_slab+0xc0/0x4b0 [ 72.878365][ T3158] ? deferred_probe_work_func+0x230/0x230 [ 72.883306][ C0] ___slab_alloc+0x81e/0xdf0 [ 72.888832][ T3158] bus_for_each_drv+0x175/0x200 [ 72.893520][ C0] kmem_cache_alloc_node_trace+0x1dd/0x300 [ 72.898377][ T3158] ? _raw_spin_unlock+0x40/0x40 [ 72.903124][ C0] dd_init_sched+0x88/0x580 [ 72.907816][ T3158] ? subsys_find_device_by_id+0x350/0x350 [ 72.912211][ C0] blk_mq_init_sched+0x6aa/0xf70 [ 72.916779][ T3158] ? lockdep_hardirqs_on+0x94/0x140 [ 72.921681][ C0] elevator_init_mq+0x32c/0x450 [ 72.927778][ T3158] __device_attach+0x29b/0x460 [ 72.932091][ C0] device_add_disk+0x8d/0xd40 [ 72.936270][ T3158] ? device_attach+0x20/0x20 [ 72.940598][ C0] nbd_dev_add+0x757/0xb20 [ 72.945738][ T3158] ? kobject_uevent_env+0x371/0x890 [ 72.947821][ C0] nbd_init+0x21c/0x2d0 [ 72.951811][ T3158] bus_probe_device+0xbc/0x1e0 [ 72.956754][ C0] do_one_initcall+0x1ee/0x680 [ 72.956777][ C0] do_initcall_level+0x137/0x1f0 [ 72.956794][ C0] do_initcalls+0x4b/0x90 [ 72.956809][ C0] kernel_init_freeable+0x3ce/0x560 [ 72.956827][ C0] page_owner free stack trace missing [ 72.956834][ C0] [ 72.956839][ C0] Memory state around the buggy address: [ 72.956852][ C0] ffff8880203eec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.961423][ T3158] ? device_add+0x97c/0xfb0 [ 72.967229][ C0] ffff8880203eec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.967244][ C0] >ffff8880203eed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.967254][ C0] ^ [ 72.967266][ C0] ffff8880203eed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.967278][ C0] ffff8880203eee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.967287][ C0] ================================================================== [ 72.967295][ C0] Disabling lock debugging due to kernel taint [ 72.967470][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.972510][ T3158] device_add+0xa00/0xfb0 [ 72.977317][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B syzkaller #0 [ 72.977338][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 72.977349][ C0] Call Trace: [ 72.977355][ C0] [ 72.977363][ C0] dump_stack_lvl+0x168/0x230 [ 72.982733][ T3158] usb_new_device+0xd53/0x1640 [ 72.987489][ C0] ? show_regs_print_info+0x20/0x20 [ 72.987512][ C0] ? load_image+0x3b0/0x3b0 [ 72.987535][ C0] panic+0x2c9/0x7f0 [ 72.987553][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 72.987570][ C0] ? _raw_spin_unlock_irqrestore+0xa5/0x100 [ 72.991500][ T3158] ? lock_chain_count+0x20/0x20 [ 72.996828][ C0] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 72.996853][ C0] ? _raw_spin_unlock+0x40/0x40 [ 72.996872][ C0] ? snd_usbmidi_error_timer+0x5fe/0x660 [ 73.001719][ T3158] ? usb_disconnect+0x8a0/0x8a0 [ 73.006732][ C0] check_panic_on_warn+0x80/0xa0 [ 73.006757][ C0] ? snd_usbmidi_error_timer+0x5fe/0x660 [ 73.006775][ C0] end_report+0x6d/0xf0 [ 73.006794][ C0] kasan_report+0x102/0x130 [ 73.006813][ C0] ? snd_usbmidi_error_timer+0x5fe/0x660 [ 73.006836][ C0] snd_usbmidi_error_timer+0x5fe/0x660 [ 73.012168][ T3158] ? _raw_spin_unlock_irq+0x1f/0x40 [ 73.016988][ C0] ? __snd_usbmidi_create+0x2f90/0x2f90 [ 73.017011][ C0] call_timer_fn+0x16c/0x530 [ 73.017032][ C0] ? __snd_usbmidi_create+0x2f90/0x2f90 [ 73.022225][ T3158] ? lockdep_hardirqs_on+0x94/0x140 [ 73.026810][ C0] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 73.026836][ C0] ? __run_timers+0x7c0/0x7c0 [ 73.026858][ C0] ? rcu_is_watching+0x11/0xa0 [ 73.026875][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 73.026893][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 73.031428][ T3158] hub_event+0x2dd9/0x5560 [ 73.035886][ C0] ? __snd_usbmidi_create+0x2f90/0x2f90 [ 73.035915][ C0] __run_timers+0x525/0x7c0 [ 73.041134][ T3158] ? hub_post_resume+0x120/0x120 [ 73.046043][ C0] ? detach_timer+0x2b0/0x2b0 [ 73.046066][ C0] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 73.046089][ C0] ? sched_clock_cpu+0x15/0x3c0 [ 73.046107][ C0] ? ktime_get_real_ts64+0x420/0x420 [ 73.046133][ C0] run_timer_softirq+0x63/0xf0 [ 73.051370][ T3520] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 73.055731][ C0] handle_softirqs+0x328/0x820 [ 73.055756][ C0] ? __irq_exit_rcu+0x12f/0x220 [ 73.055777][ C0] ? do_softirq+0x200/0x200 [ 73.060357][ T3520] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.065631][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 73.065656][ C0] __irq_exit_rcu+0x12f/0x220 [ 73.070687][ T3158] ? read_lock_is_recursive+0x10/0x10 [ 73.076037][ C0] ? irq_exit_rcu+0x20/0x20 [ 73.076062][ C0] irq_exit_rcu+0x5/0x20 [ 73.076078][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 73.080927][ T3158] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 73.085685][ C0] [ 73.085693][ C0] [ 73.085700][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 73.090474][ T3520] usb 5-1: Product: syz [ 73.094774][ C0] RIP: 0010:default_idle+0xb/0x10 [ 73.094797][ C0] Code: bf 48 89 df e8 c6 03 11 f8 eb b5 e8 ef b5 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 00 cc 66 90 0f 00 2d 17 93 5a 00 fb f4 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48 [ 73.094814][ C0] RSP: 0018:ffffffff8be07dc8 EFLAGS: 000002c6 [ 73.100256][ T3520] usb 5-1: Manufacturer: syz [ 73.105730][ C0] [ 73.105736][ C0] RAX: 80c42dcc23f1ab00 RBX: ffffffff8bebc480 RCX: 80c42dcc23f1ab00 [ 73.105754][ C0] RDX: 0000000000000001 RSI: ffffffff8a0b1be0 RDI: ffffffff8a59e800 [ 73.110607][ T3158] ? _raw_spin_unlock+0x40/0x40 [ 73.115790][ C0] RBP: ffffffff8be07ef8 R08: dffffc0000000000 R09: ffffed1017207662 [ 73.115807][ C0] R10: ffffed1017207662 R11: 1ffff11017207661 R12: ffffffff8d6935a8 [ 73.115821][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff17d7890 [ 73.115842][ C0] default_idle_call+0x81/0xc0 [ 73.120331][ T3158] ? _raw_spin_unlock_irq+0x1f/0x40 [ 73.125605][ C0] do_idle+0x21b/0x5b0 [ 73.125632][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 73.130664][ T3520] usb 5-1: SerialNumber: syz [ 73.135399][ C0] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 73.135428][ C0] cpu_startup_entry+0x14/0x20 [ 73.135450][ C0] ? time_init+0x40/0x40 [ 73.141579][ T3158] process_one_work+0x863/0x1000 [ 73.145673][ C0] start_kernel+0x486/0x530 [ 73.145705][ C0] secondary_startup_64_no_verify+0xb1/0xbb [ 73.150476][ T3158] ? worker_detach_from_pool+0x240/0x240 [ 73.155231][ C0] [ 73.155534][ C0] Kernel Offset: disabled [ 74.033820][ C0] Rebooting in 86400 seconds..