Warning: Permanently added '10.128.1.55' (ED25519) to the list of known hosts. 2025/10/06 05:32:46 parsed 1 programs [ 90.314528][ T5851] cgroup: Unknown subsys name 'net' [ 90.452119][ T5851] cgroup: Unknown subsys name 'cpuset' [ 90.461429][ T5851] cgroup: Unknown subsys name 'rlimit' [ 92.029852][ T9] cfg80211: failed to load regulatory.db [ 92.212465][ T5851] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 95.239031][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.251493][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.281509][ T1035] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.289697][ T1035] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.331943][ T5864] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 98.873540][ T5923] chnl_net:caif_netlink_parms(): no params data found [ 98.965977][ T5923] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.974030][ T5923] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.981365][ T5923] bridge_slave_0: entered allmulticast mode [ 98.989427][ T5923] bridge_slave_0: entered promiscuous mode [ 98.999072][ T5923] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.006661][ T5923] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.014000][ T5923] bridge_slave_1: entered allmulticast mode [ 99.021475][ T5923] bridge_slave_1: entered promiscuous mode [ 99.056034][ T5923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.068438][ T5923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.104650][ T5923] team0: Port device team_slave_0 added [ 99.113162][ T5923] team0: Port device team_slave_1 added [ 99.146152][ T5923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.153969][ T5923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.179911][ T5923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.192898][ T5923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.200101][ T5923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.226360][ T5923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.277114][ T5923] hsr_slave_0: entered promiscuous mode [ 99.283918][ T5923] hsr_slave_1: entered promiscuous mode [ 99.454820][ T5923] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.468414][ T5923] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.479856][ T5923] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.491304][ T5923] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.528143][ T5923] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.535447][ T5923] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.543673][ T5923] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.551013][ T5923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.615814][ T5923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.636474][ T1111] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.645552][ T1111] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.663946][ T5923] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.679300][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.686459][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.701278][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.708502][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.912746][ T5923] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.964694][ T5923] veth0_vlan: entered promiscuous mode [ 99.978861][ T5923] veth1_vlan: entered promiscuous mode [ 100.012856][ T5923] veth0_macvtap: entered promiscuous mode [ 100.023106][ T5923] veth1_macvtap: entered promiscuous mode [ 100.046030][ T5923] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.062622][ T5923] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.078944][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.091095][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.100860][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.114993][ T3586] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.251216][ T3586] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.341563][ T3586] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.425284][ T3586] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.453852][ T5949] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.462363][ T5949] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.470548][ T5949] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.479347][ T5949] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.487095][ T5949] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.512272][ T3586] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/10/06 05:33:00 executed programs: 0 [ 101.091571][ T5949] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.100225][ T5949] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.108190][ T5949] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.116963][ T5949] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.124804][ T5949] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 101.310499][ T5959] chnl_net:caif_netlink_parms(): no params data found [ 101.393366][ T5959] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.401436][ T5959] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.408973][ T5959] bridge_slave_0: entered allmulticast mode [ 101.416341][ T5959] bridge_slave_0: entered promiscuous mode [ 101.427403][ T5959] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.434769][ T5959] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.442564][ T5959] bridge_slave_1: entered allmulticast mode [ 101.450275][ T5959] bridge_slave_1: entered promiscuous mode [ 101.490871][ T5959] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.506097][ T5959] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.547275][ T5959] team0: Port device team_slave_0 added [ 101.556556][ T5959] team0: Port device team_slave_1 added [ 101.591725][ T5959] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.599131][ T5959] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.625387][ T5959] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.639428][ T5959] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.646406][ T5959] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.673300][ T5959] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.731663][ T5959] hsr_slave_0: entered promiscuous mode [ 101.738285][ T5959] hsr_slave_1: entered promiscuous mode [ 101.744663][ T5959] debugfs: 'hsr0' already exists in 'hsr' [ 101.751074][ T5959] Cannot create hsr debugfs directory [ 103.125854][ T3586] bridge_slave_1: left allmulticast mode [ 103.132201][ T3586] bridge_slave_1: left promiscuous mode [ 103.139054][ T3586] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.150830][ T3586] bridge_slave_0: left allmulticast mode [ 103.156512][ T3586] bridge_slave_0: left promiscuous mode [ 103.161708][ T5166] Bluetooth: hci0: command tx timeout [ 103.164710][ T3586] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.405674][ T3586] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 103.417650][ T3586] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 103.427840][ T3586] bond0 (unregistering): Released all slaves [ 103.564806][ T3586] hsr_slave_0: left promiscuous mode [ 103.572544][ T3586] hsr_slave_1: left promiscuous mode [ 103.582731][ T3586] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.591832][ T3586] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.601036][ T3586] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.608815][ T3586] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.630511][ T3586] veth1_macvtap: left promiscuous mode [ 103.636274][ T3586] veth0_macvtap: left promiscuous mode [ 103.643978][ T3586] veth1_vlan: left promiscuous mode [ 103.650198][ T3586] veth0_vlan: left promiscuous mode [ 104.222768][ T3586] team0 (unregistering): Port device team_slave_1 removed [ 104.266265][ T3586] team0 (unregistering): Port device team_slave_0 removed [ 104.851711][ T5959] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.878447][ T5959] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.894130][ T5959] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.906328][ T5959] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.228065][ T5166] Bluetooth: hci0: command tx timeout [ 105.262889][ T5959] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.295654][ T5959] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.312590][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.319848][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.354319][ T1111] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.361567][ T1111] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.672541][ T5959] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.744649][ T5959] veth0_vlan: entered promiscuous mode [ 105.762109][ T5959] veth1_vlan: entered promiscuous mode [ 105.809414][ T5959] veth0_macvtap: entered promiscuous mode [ 105.822921][ T5959] veth1_macvtap: entered promiscuous mode [ 105.853731][ T5959] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.874764][ T5959] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.893835][ T1035] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.914958][ T1035] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.937185][ T1035] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.964810][ T1035] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.022525][ T1035] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.040249][ T1035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.079594][ T3586] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.087475][ T3586] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.388926][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 106.548310][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 106.556095][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 106.565869][ T9] usb 1-1: config 0 has an invalid interface number: 44 but max is 0 [ 106.574700][ T9] usb 1-1: config 0 has no interface number 0 [ 106.580873][ T9] usb 1-1: config 0 interface 44 has no altsetting 0 [ 106.592767][ T9] usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=31.09 [ 106.602052][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.610447][ T9] usb 1-1: Product: syz [ 106.614636][ T9] usb 1-1: Manufacturer: syz [ 106.619319][ T9] usb 1-1: SerialNumber: syz [ 106.627379][ T9] usb 1-1: config 0 descriptor?? [ 106.856151][ T9] usb 1-1: USB disconnect, device number 2 [ 106.867461][ T9] ================================================================== [ 106.875575][ T9] BUG: KASAN: slab-use-after-free in hdm_disconnect+0x10d/0x1c0 [ 106.883272][ T9] Read of size 8 at addr ffff8880792b58a0 by task kworker/0:0/9 [ 106.890941][ T9] [ 106.893284][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 106.893302][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 106.893312][ T9] Workqueue: usb_hub_wq hub_event [ 106.893337][ T9] Call Trace: [ 106.893347][ T9] [ 106.893354][ T9] dump_stack_lvl+0x189/0x250 [ 106.893371][ T9] ? __kasan_check_byte+0x12/0x40 [ 106.893389][ T9] ? __pfx_dump_stack_lvl+0x10/0x10 [ 106.893403][ T9] ? lock_release+0x4b/0x3e0 [ 106.893423][ T9] ? __virt_addr_valid+0x4a5/0x5c0 [ 106.893439][ T9] print_report+0xca/0x240 [ 106.893456][ T9] ? hdm_disconnect+0x10d/0x1c0 [ 106.893473][ T9] kasan_report+0x118/0x150 [ 106.893490][ T9] ? hdm_disconnect+0x10d/0x1c0 [ 106.893510][ T9] hdm_disconnect+0x10d/0x1c0 [ 106.893528][ T9] usb_unbind_interface+0x26e/0x910 [ 106.893548][ T9] ? __pfx_usb_unbind_interface+0x10/0x10 [ 106.893564][ T9] device_release_driver_internal+0x4d9/0x800 [ 106.893584][ T9] bus_remove_device+0x34d/0x410 [ 106.893608][ T9] device_del+0x511/0x8e0 [ 106.893624][ T9] ? __pm_runtime_barrier+0x212/0x460 [ 106.893642][ T9] ? __pfx_device_del+0x10/0x10 [ 106.893656][ T9] ? __pfx___mutex_lock+0x10/0x10 [ 106.893678][ T9] usb_disable_device+0x3e9/0x8a0 [ 106.893695][ T9] usb_disconnect+0x330/0x950 [ 106.893719][ T9] hub_event+0x1cf5/0x4a20 [ 106.893743][ T9] ? do_raw_spin_lock+0x121/0x290 [ 106.893759][ T9] ? register_lock_class+0x51/0x320 [ 106.893782][ T9] ? __pfx_hub_event+0x10/0x10 [ 106.893801][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 106.893824][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 106.893838][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 106.893857][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 106.893877][ T9] process_scheduled_works+0xae1/0x17b0 [ 106.893908][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 106.893934][ T9] worker_thread+0x8a0/0xda0 [ 106.893963][ T9] kthread+0x711/0x8a0 [ 106.893978][ T9] ? __pfx_worker_thread+0x10/0x10 [ 106.893998][ T9] ? __pfx_kthread+0x10/0x10 [ 106.894012][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 106.894026][ T9] ? lockdep_hardirqs_on+0x9c/0x150 [ 106.894042][ T9] ? __pfx_kthread+0x10/0x10 [ 106.894056][ T9] ret_from_fork+0x4bc/0x870 [ 106.894076][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 106.894098][ T9] ? __switch_to_asm+0x39/0x70 [ 106.894113][ T9] ? __switch_to_asm+0x33/0x70 [ 106.894129][ T9] ? __pfx_kthread+0x10/0x10 [ 106.894143][ T9] ret_from_fork_asm+0x1a/0x30 [ 106.894166][ T9] [ 106.894171][ T9] [ 107.144221][ T9] Allocated by task 9: [ 107.148290][ T9] kasan_save_track+0x3e/0x80 [ 107.153002][ T9] __kasan_kmalloc+0x93/0xb0 [ 107.157596][ T9] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 107.162980][ T9] hdm_probe+0x96/0x1400 [ 107.167231][ T9] usb_probe_interface+0x668/0xc30 [ 107.172355][ T9] really_probe+0x26d/0x9e0 [ 107.176863][ T9] __driver_probe_device+0x18c/0x2f0 [ 107.182153][ T9] driver_probe_device+0x4f/0x430 [ 107.187184][ T9] __device_attach_driver+0x2ce/0x530 [ 107.192567][ T9] bus_for_each_drv+0x251/0x2e0 [ 107.197432][ T9] __device_attach+0x2b8/0x400 [ 107.202218][ T9] bus_probe_device+0x185/0x260 [ 107.207082][ T9] device_add+0x7b6/0xb50 [ 107.211412][ T9] usb_set_configuration+0x1a87/0x20e0 [ 107.216877][ T9] usb_generic_driver_probe+0x8d/0x150 [ 107.222339][ T9] usb_probe_device+0x1c4/0x390 [ 107.227196][ T9] really_probe+0x26d/0x9e0 [ 107.231728][ T9] __driver_probe_device+0x18c/0x2f0 [ 107.237021][ T9] driver_probe_device+0x4f/0x430 [ 107.242061][ T9] __device_attach_driver+0x2ce/0x530 [ 107.247439][ T9] bus_for_each_drv+0x251/0x2e0 [ 107.252298][ T9] __device_attach+0x2b8/0x400 [ 107.257068][ T9] bus_probe_device+0x185/0x260 [ 107.261927][ T9] device_add+0x7b6/0xb50 [ 107.266261][ T9] usb_new_device+0xa39/0x16f0 [ 107.271036][ T9] hub_event+0x2958/0x4a20 [ 107.275453][ T9] process_scheduled_works+0xae1/0x17b0 [ 107.281007][ T9] worker_thread+0x8a0/0xda0 [ 107.285607][ T9] kthread+0x711/0x8a0 [ 107.289673][ T9] ret_from_fork+0x4bc/0x870 [ 107.294275][ T9] ret_from_fork_asm+0x1a/0x30 [ 107.299047][ T9] [ 107.301374][ T9] Freed by task 9: [ 107.305093][ T9] kasan_save_track+0x3e/0x80 [ 107.309771][ T9] __kasan_save_free_info+0x46/0x50 [ 107.314982][ T9] __kasan_slab_free+0x5c/0x80 [ 107.319746][ T9] kfree+0x19a/0x6d0 [ 107.323668][ T9] device_release+0x9c/0x1c0 [ 107.328281][ T9] kobject_put+0x22b/0x480 [ 107.332709][ T9] hdm_disconnect+0xf3/0x1c0 [ 107.337302][ T9] usb_unbind_interface+0x26e/0x910 [ 107.342503][ T9] device_release_driver_internal+0x4d9/0x800 [ 107.348572][ T9] bus_remove_device+0x34d/0x410 [ 107.353526][ T9] device_del+0x511/0x8e0 [ 107.357864][ T9] usb_disable_device+0x3e9/0x8a0 [ 107.362896][ T9] usb_disconnect+0x330/0x950 [ 107.367583][ T9] hub_event+0x1cf5/0x4a20 [ 107.372001][ T9] process_scheduled_works+0xae1/0x17b0 [ 107.377557][ T9] worker_thread+0x8a0/0xda0 [ 107.382157][ T9] kthread+0x711/0x8a0 [ 107.386230][ T9] ret_from_fork+0x4bc/0x870 [ 107.390843][ T9] ret_from_fork_asm+0x1a/0x30 [ 107.395615][ T9] [ 107.397944][ T9] The buggy address belongs to the object at ffff8880792b4000 [ 107.397944][ T9] which belongs to the cache kmalloc-8k of size 8192 [ 107.412000][ T9] The buggy address is located 6304 bytes inside of [ 107.412000][ T9] freed 8192-byte region [ffff8880792b4000, ffff8880792b6000) [ 107.425976][ T9] [ 107.428301][ T9] The buggy address belongs to the physical page: [ 107.434742][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x792b0 [ 107.443498][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 107.451997][ T9] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 107.459987][ T9] page_type: f5(slab) [ 107.463978][ T9] raw: 00fff00000000040 ffff88813fe27280 0000000000000000 dead000000000001 [ 107.472563][ T9] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 107.481152][ T9] head: 00fff00000000040 ffff88813fe27280 0000000000000000 dead000000000001 [ 107.489842][ T9] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 107.498517][ T9] head: 00fff00000000003 ffffea0001e4ac01 00000000ffffffff 00000000ffffffff [ 107.507190][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 107.515853][ T9] page dumped because: kasan: bad access detected [ 107.522276][ T9] page_owner tracks the page as allocated [ 107.527994][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5491, tgid 5491 (S30dbus), ts 55592891401, free_ts 55475350286 [ 107.548233][ T9] post_alloc_hook+0x240/0x2a0 [ 107.553003][ T9] get_page_from_freelist+0x2365/0x2440 [ 107.558560][ T9] __alloc_frozen_pages_noprof+0x181/0x370 [ 107.564371][ T9] alloc_pages_mpol+0x232/0x4a0 [ 107.569237][ T9] allocate_slab+0x96/0x3a0 [ 107.573761][ T9] ___slab_alloc+0xe94/0x18a0 [ 107.578450][ T9] __slab_alloc+0x65/0x100 [ 107.582883][ T9] __kmalloc_cache_noprof+0x411/0x6f0 [ 107.588280][ T9] tomoyo_init_log+0x111f/0x1f70 [ 107.593267][ T9] tomoyo_supervisor+0x340/0x1480 [ 107.598303][ T9] tomoyo_env_perm+0x149/0x1e0 [ 107.603077][ T9] tomoyo_find_next_domain+0x15cf/0x1aa0 [ 107.608719][ T9] tomoyo_bprm_check_security+0x11c/0x180 [ 107.614449][ T9] security_bprm_check+0x89/0x270 [ 107.619483][ T9] bprm_execve+0x8ee/0x1450 [ 107.623988][ T9] do_execveat_common+0x510/0x6a0 [ 107.629019][ T9] page last free pid 5229 tgid 5229 stack trace: [ 107.635348][ T9] __free_frozen_pages+0xbc4/0xd30 [ 107.640468][ T9] __put_partials+0x146/0x170 [ 107.645151][ T9] put_cpu_partial+0x1f2/0x2e0 [ 107.649930][ T9] __slab_free+0x2b9/0x390 [ 107.654362][ T9] qlist_free_all+0x97/0x140 [ 107.658985][ T9] kasan_quarantine_reduce+0x148/0x160 [ 107.664476][ T9] __kasan_slab_alloc+0x22/0x80 [ 107.669344][ T9] kmem_cache_alloc_node_noprof+0x433/0x710 [ 107.675263][ T9] __alloc_skb+0x112/0x2d0 [ 107.679690][ T9] netlink_sendmsg+0x5c6/0xb30 [ 107.684458][ T9] __sock_sendmsg+0x21c/0x270 [ 107.689151][ T9] ____sys_sendmsg+0x505/0x830 [ 107.693923][ T9] ___sys_sendmsg+0x21f/0x2a0 [ 107.698618][ T9] __x64_sys_sendmsg+0x19b/0x260 [ 107.703567][ T9] do_syscall_64+0xfa/0xfa0 [ 107.708076][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.713993][ T9] [ 107.716339][ T9] Memory state around the buggy address: [ 107.721981][ T9] ffff8880792b5780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.730050][ T9] ffff8880792b5800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.738134][ T9] >ffff8880792b5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.746195][ T9] ^ [ 107.751306][ T9] ffff8880792b5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.759370][ T9] ffff8880792b5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.767524][ T9] ================================================================== [ 107.798010][ T5166] Bluetooth: hci0: command tx timeout [ 107.808849][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 107.816111][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 107.825243][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 107.835326][ T9] Workqueue: usb_hub_wq hub_event [ 107.840433][ T9] Call Trace: [ 107.843729][ T9] [ 107.846667][ T9] dump_stack_lvl+0x99/0x250 [ 107.851290][ T9] ? __asan_memcpy+0x40/0x70 [ 107.855889][ T9] ? __pfx_dump_stack_lvl+0x10/0x10 [ 107.861092][ T9] ? __pfx__printk+0x10/0x10 [ 107.865711][ T9] vpanic+0x237/0x6d0 [ 107.869718][ T9] ? __pfx_vpanic+0x10/0x10 [ 107.874262][ T9] ? preempt_schedule+0xae/0xc0 [ 107.879115][ T9] ? __pfx_preempt_schedule+0x10/0x10 [ 107.884627][ T9] panic+0xb9/0xc0 [ 107.888364][ T9] ? __pfx_panic+0x10/0x10 [ 107.892785][ T9] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 107.898695][ T9] ? hdm_disconnect+0x10d/0x1c0 [ 107.903550][ T9] check_panic_on_warn+0x89/0xb0 [ 107.908491][ T9] ? hdm_disconnect+0x10d/0x1c0 [ 107.913355][ T9] end_report+0x78/0x160 [ 107.917609][ T9] kasan_report+0x129/0x150 [ 107.922127][ T9] ? hdm_disconnect+0x10d/0x1c0 [ 107.927003][ T9] hdm_disconnect+0x10d/0x1c0 [ 107.931695][ T9] usb_unbind_interface+0x26e/0x910 [ 107.936918][ T9] ? __pfx_usb_unbind_interface+0x10/0x10 [ 107.942663][ T9] device_release_driver_internal+0x4d9/0x800 [ 107.948750][ T9] bus_remove_device+0x34d/0x410 [ 107.953707][ T9] device_del+0x511/0x8e0 [ 107.958143][ T9] ? __pm_runtime_barrier+0x212/0x460 [ 107.963525][ T9] ? __pfx_device_del+0x10/0x10 [ 107.968386][ T9] ? __pfx___mutex_lock+0x10/0x10 [ 107.973433][ T9] usb_disable_device+0x3e9/0x8a0 [ 107.978473][ T9] usb_disconnect+0x330/0x950 [ 107.983167][ T9] hub_event+0x1cf5/0x4a20 [ 107.987602][ T9] ? do_raw_spin_lock+0x121/0x290 [ 107.992639][ T9] ? register_lock_class+0x51/0x320 [ 107.997866][ T9] ? __pfx_hub_event+0x10/0x10 [ 108.002657][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 108.008393][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.013603][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 108.019346][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 108.025082][ T9] process_scheduled_works+0xae1/0x17b0 [ 108.030657][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 108.036664][ T9] worker_thread+0x8a0/0xda0 [ 108.041471][ T9] kthread+0x711/0x8a0 [ 108.045593][ T9] ? __pfx_worker_thread+0x10/0x10 [ 108.050726][ T9] ? __pfx_kthread+0x10/0x10 [ 108.055328][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.060542][ T9] ? lockdep_hardirqs_on+0x9c/0x150 [ 108.065750][ T9] ? __pfx_kthread+0x10/0x10 [ 108.070363][ T9] ret_from_fork+0x4bc/0x870 [ 108.074969][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 108.080101][ T9] ? __switch_to_asm+0x39/0x70 [ 108.084879][ T9] ? __switch_to_asm+0x33/0x70 [ 108.089663][ T9] ? __pfx_kthread+0x10/0x10 [ 108.094261][ T9] ret_from_fork_asm+0x1a/0x30 [ 108.099043][ T9] [ 108.102425][ T9] Kernel Offset: disabled [ 108.106758][ T9] Rebooting in 86400 seconds..