Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts.
2026/09/18 16:54:34 parsed 1 programs
[ 52.187188][ T29] kauditd_printk_skb: 1 callbacks suppressed
[ 52.187254][ T29] audit: type=1400 audit(1789750474.001:77): avc: denied { node_bind } for pid=2983 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 52.215105][ T29] audit: type=1400 audit(1789750474.001:78): avc: denied { module_request } for pid=2983 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
2026/09/18 16:54:34 serving rpc on tcp://35925
[ 55.494786][ T29] audit: type=1400 audit(1789750477.311:79): avc: denied { mounton } for pid=2993 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 55.518940][ T29] audit: type=1400 audit(1789750477.331:80): avc: denied { mount } for pid=2993 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 55.530112][ T2993] cgroup: Unknown subsys name 'net'
[ 55.541972][ T29] audit: type=1400 audit(1789750477.351:81): avc: denied { unmount } for pid=2993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 55.665428][ T2993] cgroup: Unknown subsys name 'cpuset'
[ 55.673232][ T2993] cgroup: Unknown subsys name 'rlimit'
[ 55.814062][ T29] audit: type=1400 audit(1789750477.631:82): avc: denied { setattr } for pid=2993 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 55.820686][ T29] audit: type=1400 audit(1789750477.631:83): avc: denied { create } for pid=2993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 55.820868][ T29] audit: type=1400 audit(1789750477.631:84): avc: denied { write } for pid=2993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 55.821016][ T29] audit: type=1400 audit(1789750477.631:85): avc: denied { read } for pid=2993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 55.911206][ T29] audit: type=1400 audit(1789750477.721:86): avc: denied { sys_module } for pid=2993 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 56.042506][ T2997] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 56.087029][ T2993] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 57.672133][ T29] kauditd_printk_skb: 8 callbacks suppressed
[ 57.672208][ T29] audit: type=1400 audit(1789750479.481:95): avc: denied { execmem } for pid=2999 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 57.809952][ T29] audit: type=1400 audit(1789750479.621:96): avc: denied { read } for pid=3000 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 57.831396][ T29] audit: type=1400 audit(1789750479.621:97): avc: denied { open } for pid=3000 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 57.831470][ T29] audit: type=1400 audit(1789750479.631:98): avc: denied { mounton } for pid=3000 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 57.894074][ T29] audit: type=1400 audit(1789750479.711:99): avc: denied { mounton } for pid=3000 comm="syz-executor" path="/root/syzkaller.dEq39L/syz-tmp" dev="sda1" ino=2031 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 57.918528][ T29] audit: type=1400 audit(1789750479.711:100): avc: denied { mount } for pid=3000 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 57.918603][ T29] audit: type=1400 audit(1789750479.711:101): avc: denied { mounton } for pid=3000 comm="syz-executor" path="/root/syzkaller.dEq39L/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[ 57.918666][ T29] audit: type=1400 audit(1789750479.721:102): avc: denied { mount } for pid=3000 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
[ 57.918728][ T29] audit: type=1400 audit(1789750479.721:103): avc: denied { mounton } for pid=3000 comm="syz-executor" path="/root/syzkaller.dEq39L/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1
[ 57.918807][ T29] audit: type=1400 audit(1789750479.731:104): avc: denied { mounton } for pid=3000 comm="syz-executor" path="/root/syzkaller.dEq39L/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2677 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1
[ 58.093720][ T3000] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 63.254432][ T29] kauditd_printk_skb: 9 callbacks suppressed
[ 63.254504][ T29] audit: type=1400 audit(1789750485.071:114): avc: denied { create } for pid=3042 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 74.286005][ T29] audit: type=1400 audit(1789750496.101:115): avc: denied { create } for pid=3507 comm="syz-executor" name="tun" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 74.307692][ T29] audit: type=1400 audit(1789750496.131:116): avc: denied { setattr } for pid=3507 comm="syz-executor" name="tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 74.327544][ T29] audit: type=1400 audit(1789750496.131:117): avc: denied { read write } for pid=3507 comm="syz-executor" name="tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 74.327804][ T29] audit: type=1400 audit(1789750496.131:118): avc: denied { open } for pid=3507 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 74.441654][ T29] audit: type=1400 audit(1789750496.251:119): avc: denied { create } for pid=3509 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1
[ 74.461757][ T29] audit: type=1400 audit(1789750496.251:120): avc: denied { sys_admin } for pid=3509 comm="syz-executor" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1
[ 74.501818][ T29] audit: type=1400 audit(1789750496.311:121): avc: denied { sys_chroot } for pid=3510 comm="syz-executor" capability=18 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1
2026/09/18 16:54:56 executed programs: 0
2026/09/18 16:55:10 executed programs: 2
[ 89.110116][ T29] audit: type=1400 audit(1789750510.921:122): avc: denied { read write } for pid=3974 comm="syz.3.17" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 89.134104][ T29] audit: type=1400 audit(1789750510.921:123): avc: denied { open } for pid=3974 comm="syz.3.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 89.134191][ T29] audit: type=1400 audit(1789750510.931:124): avc: denied { ioctl } for pid=3974 comm="syz.3.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 89.412427][ T11] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 89.563611][ T11] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 89.569048][ T11] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 89.569238][ T11] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 89.569581][ T11] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 92.117381][ T758] usb 4-1: USB disconnect, device number 2
[ 92.482229][ T758] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[ 92.632760][ T758] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 92.634936][ T758] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 92.635083][ T758] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 92.635239][ T758] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 95.148773][ T9] usb 4-1: USB disconnect, device number 3
2026/09/18 16:55:17 executed programs: 4
[ 95.492210][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[ 95.642739][ T9] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 95.644999][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 95.645171][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 95.645318][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 98.178640][ T9] usb 4-1: USB disconnect, device number 4
[ 98.522262][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[ 98.672807][ T9] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 98.676319][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 98.676502][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 98.676653][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 101.202593][ T9] usb 4-1: USB disconnect, device number 5
2026/09/18 16:55:23 executed programs: 6
[ 101.552237][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd
[ 101.702811][ T9] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 101.705049][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 101.705253][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 101.705397][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 104.230546][ T11] usb 4-1: USB disconnect, device number 6
[ 104.582260][ T11] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[ 104.732675][ T11] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 104.735045][ T11] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 104.735189][ T11] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 104.735347][ T11] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
2026/09/18 16:55:29 executed programs: 8
[ 107.259318][ T1131] usb 4-1: USB disconnect, device number 7
[ 107.602206][ T1131] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[ 107.752796][ T1131] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 107.755040][ T1131] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 107.755222][ T1131] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 107.755376][ T1131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 110.291544][ T1131] usb 4-1: USB disconnect, device number 8
[ 110.632192][ T1131] usb 4-1: new high-speed USB device number 9 using dummy_hcd
[ 110.782841][ T1131] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 110.785036][ T1131] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 110.785199][ T1131] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 110.785360][ T1131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
2026/09/18 16:55:35 executed programs: 10
[ 113.320269][ T24] usb 4-1: USB disconnect, device number 9
[ 113.672201][ T24] usb 4-1: new high-speed USB device number 10 using dummy_hcd
[ 113.822794][ T24] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 113.824660][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 113.824825][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 113.824968][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 116.350387][ T1131] usb 4-1: USB disconnect, device number 10
[ 116.692183][ T1131] usb 4-1: new high-speed USB device number 11 using dummy_hcd
[ 116.843122][ T1131] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 116.845285][ T1131] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 116.845436][ T1131] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 116.845575][ T1131] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 119.373024][ T758] usb 4-1: USB disconnect, device number 11
2026/09/18 16:55:41 executed programs: 12
[ 119.712260][ T758] usb 4-1: new high-speed USB device number 12 using dummy_hcd
[ 119.862786][ T758] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 119.864800][ T758] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 119.864961][ T758] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 119.865102][ T758] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 121.652761][ T758] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -110
[ 122.398502][ T758] usb 4-1: USB disconnect, device number 12
[ 122.742260][ T758] usb 4-1: new high-speed USB device number 13 using dummy_hcd
[ 122.892669][ T758] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 122.894787][ T758] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 122.894939][ T758] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 122.895084][ T758] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
2026/09/18 16:55:47 executed programs: 14
[ 125.432321][ T9] usb 4-1: USB disconnect, device number 13
[ 125.782182][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd
[ 125.932811][ T9] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 125.934947][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 125.935198][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 125.935342][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 128.463932][ T758] usb 4-1: USB disconnect, device number 14
[ 128.812152][ T758] usb 4-1: new high-speed USB device number 15 using dummy_hcd
[ 128.962883][ T758] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 128.965104][ T758] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 128.965269][ T758] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 128.965410][ T758] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
2026/09/18 16:55:53 executed programs: 16
[ 131.495364][ T11] usb 4-1: USB disconnect, device number 15
[ 131.852178][ T11] usb 4-1: new high-speed USB device number 16 using dummy_hcd
[ 132.002797][ T11] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 132.005029][ T11] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 132.005194][ T11] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 132.005338][ T11] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 134.525239][ T42] usb 4-1: USB disconnect, device number 16
[ 134.862165][ T42] usb 4-1: new high-speed USB device number 17 using dummy_hcd
[ 135.012727][ T42] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 135.014945][ T42] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 135.015105][ T42] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 135.015264][ T42] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 137.556719][ T11] usb 4-1: USB disconnect, device number 17
[ 137.556954][ T24] ==================================================================
[ 137.556971][ T24] BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 137.557049][ T24] Write of size 4 at addr ffff88810cafa074 by task kworker/1:0/24
[ 137.557074][ T24]
[ 137.557108][ T24] CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 N
** replaying previous printk message **
[ 137.557108][ T24] CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(lazy)
[ 137.557145][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 137.557170][ T24] Workqueue: events rtsx_usb_ms_handle_req
[ 137.557215][ T24] Call Trace:
[ 137.557226][ T24]
[ 137.557241][ T24] dump_stack_lvl+0x100/0x190
[ 137.557298][ T24] print_report+0x13d/0x4b0
[ 137.557345][ T24] ? __virt_addr_valid+0x239/0x430
[ 137.557400][ T24] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 137.557435][ T24] kasan_report+0xdf/0x1c0
[ 137.557470][ T24] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 137.557510][ T24] rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 137.557553][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 137.557593][ T24] ? process_one_work+0xa2c/0x1b10
[ 137.557648][ T24] ? process_one_work+0x906/0x1b10
[ 137.557698][ T24] ? process_one_work+0x906/0x1b10
[ 137.557753][ T24] process_one_work+0xac7/0x1b10
[ 137.557813][ T24] ? __pfx_process_one_work+0x10/0x10
[ 137.557939][ T24] ? lock_acquire+0x1d1/0x380
[ 137.558036][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 137.558143][ T24] worker_thread+0x5ef/0xe50
[ 137.558301][ T24] ? kthread+0x13a/0x450
[ 137.558418][ T24] ? __pfx_worker_thread+0x10/0x10
[ 137.558564][ T24] kthread+0x373/0x450
[ 137.558688][ T24] ? __pfx_kthread+0x10/0x10
[ 137.558811][ T24] ret_from_fork+0x69f/0xc90
[ 137.558880][ T24] ? __pfx_ret_from_fork+0x10/0x10
[ 137.558962][ T24] ? __switch_to+0x7f6/0x10e0
[ 137.559075][ T24] ? __switch_to_asm+0x39/0x70
[ 137.559162][ T24] ? __pfx_kthread+0x10/0x10
[ 137.559306][ T24] ret_from_fork_asm+0x1a/0x30
[ 137.559436][ T24]
[ 137.559468][ T24]
[ 137.559488][ T24] Allocated by task 12:
[ 137.559538][ T24] kasan_save_stack+0x30/0x50
[ 137.559614][ T24] kasan_save_track+0x14/0x30
[ 137.559679][ T24] __kasan_kmalloc+0x8f/0xa0
[ 137.559786][ T24] __kmalloc_cache_noprof+0x2d8/0x680
[ 137.559872][ T24] memstick_check+0x2c1/0x10d0
[ 137.559947][ T24] process_one_work+0xac7/0x1b10
[ 137.560073][ T24] worker_thread+0x5ef/0xe50
[ 137.560179][ T24] kthread+0x373/0x450
[ 137.560285][ T24] ret_from_fork+0x69f/0xc90
[ 137.560359][ T24] ret_from_fork_asm+0x1a/0x30
[ 137.560449][ T24]
[ 137.560462][ T24] Freed by task 12:
[ 137.560495][ T24] kasan_save_stack+0x30/0x50
[ 137.560561][ T24] kasan_save_track+0x14/0x30
[ 137.560631][ T24] kasan_save_free_info+0x3b/0x70
[ 137.560736][ T24] __kasan_slab_free+0x43/0x70
[ 137.560810][ T24] kfree+0x20c/0x650
[ 137.560884][ T24] memstick_check+0x72b/0x10d0
[ 137.560971][ T24] process_one_work+0xac7/0x1b10
[ 137.561101][ T24] worker_thread+0x5ef/0xe50
[ 137.561217][ T24] kthread+0x373/0x450
[ 137.561341][ T24] ret_from_fork+0x69f/0xc90
[ 137.561408][ T24] ret_from_fork_asm+0x1a/0x30
[ 137.561486][ T24]
[ 137.561499][ T24] The buggy address belongs to the object at ffff88810cafa000
[ 137.561499][ T24] which belongs to the cache kmalloc-2k of size 2048
[ 137.561562][ T24] The buggy address is located 116 bytes inside of
[ 137.561562][ T24] freed 2048-byte region [ffff88810cafa000, ffff88810cafa800)
[ 137.561649][ T24]
[ 137.561670][ T24] The buggy address belongs to the physical page:
[ 137.561723][ T24] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10caf8
[ 137.561805][ T24] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 137.561905][ T24] flags: 0x200000000000040(head|node=0|zone=2)
[ 137.561980][ T24] page_type: f5(slab)
[ 137.562044][ T24] raw: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 137.562128][ T24] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 137.562217][ T24] head: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 137.562290][ T24] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 137.562371][ T24] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 137.562445][ T24] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 137.562494][ T24] page dumped because: kasan: bad access detected
[ 137.562535][ T24] page_owner tracks the page as allocated
[ 137.562557][ T24] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4392756443
[ 137.562698][ T24] post_alloc_hook+0xfd/0x120
[ 137.562824][ T24] get_page_from_freelist+0xf4b/0x3440
[ 137.562906][ T24] __alloc_frozen_pages_noprof+0x2d7/0x2f70
[ 137.562992][ T24] new_slab+0xa9/0x6e0
[ 137.563066][ T24] refill_objects+0xe3/0x410
[ 137.563137][ T24] __pcs_replace_empty_main+0x35e/0x650
[ 137.563220][ T24] __kmalloc_cache_noprof+0x4a1/0x680
[ 137.563304][ T24] acpi_ds_create_walk_state+0x95/0x300
[ 137.563388][ T24] acpi_ds_call_control_method+0x226/0xab0
[ 137.563504][ T24] acpi_ps_parse_aml+0xacd/0x1120
[ 137.563581][ T24] acpi_ps_execute_method+0x5c4/0xe90
[ 137.563687][ T24] acpi_ns_evaluate+0x640/0x1670
[ 137.563768][ T24] acpi_evaluate_object+0x420/0xe00
[ 137.563814][ T24] acpi_evaluate_integer+0xdf/0x220
[ 137.563852][ T24] acpi_bus_get_status+0x1a1/0x430
[ 137.563988][ T24] acpi_pci_link_set+0x50e/0xa80
[ 137.564088][ T24] page_owner free stack trace missing
[ 137.564112][ T24]
[ 137.564132][ T24] Memory state around the buggy address:
[ 137.564173][ T24] ffff88810caf9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 137.564234][ T24] ffff88810caf9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 137.564289][ T24] >ffff88810cafa000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 137.564339][ T24] ^
[ 137.564383][ T24] ffff88810cafa080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 137.564438][ T24] ffff88810cafa100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 137.564481][ T24] ==================================================================
[ 137.595787][ T24] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 138.183295][ T24] CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(lazy)
[ 138.192544][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 138.202664][ T24] Workqueue: events rtsx_usb_ms_handle_req
[ 138.208538][ T24] Call Trace:
[ 138.211836][ T24]
[ 138.214794][ T24] dump_stack_lvl+0x100/0x190
[ 138.219525][ T24] vpanic+0x553/0x970
[ 138.223540][ T24] ? __pfx_vpanic+0x10/0x10
[ 138.228096][ T24] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 138.233865][ T24] panic+0xd1/0xe0
[ 138.237636][ T24] ? __pfx_panic+0x10/0x10
[ 138.242110][ T24] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 138.247876][ T24] ? preempt_schedule_common+0x3c/0xb0
[ 138.253394][ T24] check_panic_on_warn.cold+0x19/0x34
[ 138.258824][ T24] end_report.part.0+0x3a/0x90
[ 138.263636][ T24] kasan_report.cold+0xe/0x18
[ 138.268383][ T24] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 138.274146][ T24] rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 138.279757][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 138.285697][ T24] ? process_one_work+0xa2c/0x1b10
[ 138.290899][ T24] ? process_one_work+0x906/0x1b10
[ 138.296060][ T24] ? process_one_work+0x906/0x1b10
[ 138.301229][ T24] process_one_work+0xac7/0x1b10
[ 138.306233][ T24] ? __pfx_process_one_work+0x10/0x10
[ 138.311669][ T24] ? lock_acquire+0x1d1/0x380
[ 138.316392][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 138.322336][ T24] worker_thread+0x5ef/0xe50
[ 138.326989][ T24] ? kthread+0x13a/0x450
[ 138.331289][ T24] ? __pfx_worker_thread+0x10/0x10
[ 138.336446][ T24] kthread+0x373/0x450
[ 138.340560][ T24] ? __pfx_kthread+0x10/0x10
[ 138.345204][ T24] ret_from_fork+0x69f/0xc90
[ 138.349844][ T24] ? __pfx_ret_from_fork+0x10/0x10
[ 138.354997][ T24] ? __switch_to+0x7f6/0x10e0
[ 138.359728][ T24] ? __switch_to_asm+0x39/0x70
[ 138.364627][ T24] ? __pfx_kthread+0x10/0x10
[ 138.369274][ T24] ret_from_fork_asm+0x1a/0x30
[ 138.374085][ T24]
[ 138.377698][ T24] Kernel Offset: disabled
[ 138.382051][ T24] Rebooting in 86400 seconds..