Warning: Permanently added '[localhost]:19543' (ED25519) to the list of known hosts.
2026/01/11 04:09:47 parsed 1 programs
syzkaller login: [ 86.982174][ T5324] cgroup: Unknown subsys name 'net'
[ 87.053826][ T5324] cgroup: Unknown subsys name 'cpuset'
[ 87.058449][ T5324] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 89.072136][ T5324] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 91.812115][ T9] cfg80211: failed to load regulatory.db
[ 94.486255][ T5342] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 98.520808][ T5384] chnl_net:caif_netlink_parms(): no params data found
[ 98.682341][ T5384] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.686093][ T5384] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.688903][ T5384] bridge_slave_0: entered allmulticast mode
[ 98.700830][ T5384] bridge_slave_0: entered promiscuous mode
[ 98.711390][ T5384] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.719722][ T5384] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.722933][ T5384] bridge_slave_1: entered allmulticast mode
[ 98.730383][ T5384] bridge_slave_1: entered promiscuous mode
[ 98.778559][ T5384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 98.791906][ T5384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 98.838907][ T5384] team0: Port device team_slave_0 added
[ 98.848310][ T5384] team0: Port device team_slave_1 added
[ 98.892612][ T5384] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 98.896159][ T5384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.929959][ T5384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 98.940666][ T5384] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 98.949916][ T5384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.969595][ T5384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 99.051210][ T5384] hsr_slave_0: entered promiscuous mode
[ 99.054442][ T5384] hsr_slave_1: entered promiscuous mode
[ 99.224340][ T5384] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 99.234559][ T5384] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 99.242373][ T5384] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 99.249353][ T5384] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 99.276537][ T5384] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.279821][ T5384] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 99.283771][ T5384] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.287013][ T5384] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 99.377552][ T5384] 8021q: adding VLAN 0 to HW filter on device bond0
[ 99.393758][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 99.398126][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 99.414120][ T5384] 8021q: adding VLAN 0 to HW filter on device team0
[ 99.423204][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.426094][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 99.435075][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.437983][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 99.613089][ T5384] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 99.655138][ T5384] veth0_vlan: entered promiscuous mode
[ 99.664116][ T5384] veth1_vlan: entered promiscuous mode
[ 99.692093][ T5384] veth0_macvtap: entered promiscuous mode
[ 99.702012][ T5384] veth1_macvtap: entered promiscuous mode
[ 99.731584][ T5384] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 99.752486][ T5384] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 99.765372][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.778728][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.792714][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.797073][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.930737][ T31] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 99.975703][ T5407] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.980753][ T5407] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 99.984318][ T5407] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 99.987615][ T5407] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 99.991578][ T5407] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 100.037440][ T31] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.101361][ T31] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.183093][ T31] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.645075][ T2961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.648421][ T2961] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.684408][ T2961] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.687661][ T2961] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 102.359923][ T31] bridge_slave_1: left allmulticast mode
[ 102.362425][ T31] bridge_slave_1: left promiscuous mode
[ 102.366041][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 102.391936][ T31] bridge_slave_0: left allmulticast mode
[ 102.394782][ T31] bridge_slave_0: left promiscuous mode
[ 102.397429][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
2026/01/11 04:10:05 executed programs: 0
[ 102.466189][ T46] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 102.472118][ T46] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 102.475563][ T46] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 102.479239][ T46] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 102.484690][ T46] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 102.682097][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 102.687844][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 102.693407][ T31] bond0 (unregistering): Released all slaves
[ 102.810934][ T31] hsr_slave_0: left promiscuous mode
[ 102.814159][ T31] hsr_slave_1: left promiscuous mode
[ 102.823155][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 102.826493][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 102.841463][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 102.844729][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 102.876207][ T31] veth1_macvtap: left promiscuous mode
[ 102.878711][ T31] veth0_macvtap: left promiscuous mode
[ 102.895937][ T31] veth1_vlan: left promiscuous mode
[ 102.898457][ T31] veth0_vlan: left promiscuous mode
[ 103.351610][ T31] team0 (unregistering): Port device team_slave_1 removed
[ 103.376805][ T31] team0 (unregistering): Port device team_slave_0 removed
[ 103.912671][ T5438] chnl_net:caif_netlink_parms(): no params data found
[ 104.392310][ T5438] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.396695][ T5438] bridge0: port 1(bridge_slave_0) entered disabled state
[ 104.405217][ T5438] bridge_slave_0: entered allmulticast mode
[ 104.413590][ T5438] bridge_slave_0: entered promiscuous mode
[ 104.428310][ T5438] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.436224][ T5438] bridge0: port 2(bridge_slave_1) entered disabled state
[ 104.443947][ T5438] bridge_slave_1: entered allmulticast mode
[ 104.451685][ T5438] bridge_slave_1: entered promiscuous mode
[ 104.533107][ T46] Bluetooth: hci0: command tx timeout
[ 104.569035][ T5438] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 104.592328][ T5438] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 104.676926][ T5438] team0: Port device team_slave_0 added
[ 104.686169][ T5438] team0: Port device team_slave_1 added
[ 104.773200][ T5438] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 104.776428][ T5438] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 104.829655][ T5438] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 104.848395][ T5438] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 104.859678][ T5438] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 104.889973][ T5438] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 104.980983][ T5438] hsr_slave_0: entered promiscuous mode
[ 104.990774][ T5438] hsr_slave_1: entered promiscuous mode
[ 105.488552][ T5438] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 105.502552][ T5438] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 105.511196][ T5438] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 105.533114][ T5438] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 105.679986][ T5438] 8021q: adding VLAN 0 to HW filter on device bond0
[ 105.714752][ T5438] 8021q: adding VLAN 0 to HW filter on device team0
[ 105.751230][ T2961] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.754288][ T2961] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 105.758343][ T2961] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.761416][ T2961] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 106.061242][ T5438] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 106.123017][ T5438] veth0_vlan: entered promiscuous mode
[ 106.152871][ T5438] veth1_vlan: entered promiscuous mode
[ 106.201786][ T5438] veth0_macvtap: entered promiscuous mode
[ 106.209094][ T5438] veth1_macvtap: entered promiscuous mode
[ 106.244723][ T5438] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 106.261183][ T5438] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 106.285618][ T2961] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.300962][ T2961] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.316682][ T2961] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.331650][ T2961] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.440264][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.443774][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.497588][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.515954][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.611700][ T46] Bluetooth: hci0: command tx timeout
[ 107.049743][ T10] usb 5-1: new full-speed USB device number 2 using dummy_hcd
[ 107.202490][ T10] usb 5-1: config 0 interface 0 has no altsetting 0
[ 107.207409][ T10] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[ 107.211767][ T10] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[ 107.215381][ T10] usb 5-1: Product: syz
[ 107.217356][ T10] usb 5-1: Manufacturer: syz
[ 107.219989][ T10] usb 5-1: SerialNumber: syz
[ 107.226040][ T10] usb 5-1: config 0 descriptor??
[ 107.240526][ T10] usb 5-1: selecting invalid altsetting 0
[ 107.434698][ T5502] ==================================================================
[ 107.437615][ T5502] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460
[ 107.440648][ T5502] Write of size 264 at addr ffff88801f89c200 by task syz.0.17/5502
[ 107.443856][ T5502]
[ 107.444910][ T5502] CPU: 0 UID: 0 PID: 5502 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 107.444925][ T5502] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 107.444932][ T5502] Call Trace:
[ 107.444939][ T5502]
[ 107.444945][ T5502] dump_stack_lvl+0xe8/0x150
[ 107.444962][ T5502] print_report+0xca/0x240
[ 107.444974][ T5502] ? copy_to_urb+0x261/0x460
[ 107.444983][ T5502] kasan_report+0x118/0x150
[ 107.445041][ T5502] ? copy_to_urb+0x261/0x460
[ 107.445050][ T5502] kasan_check_range+0x2b0/0x2c0
[ 107.445059][ T5502] ? copy_to_urb+0x261/0x460
[ 107.445068][ T5502] __asan_memcpy+0x40/0x70
[ 107.445082][ T5502] copy_to_urb+0x261/0x460
[ 107.445093][ T5502] prepare_playback_urb+0x953/0x13d0
[ 107.445107][ T5502] ? __pfx_prepare_playback_urb+0x10/0x10
[ 107.445116][ T5502] ? unwind_next_frame+0xa5/0x23d0
[ 107.445128][ T5502] ? rcu_is_watching+0x15/0xb0
[ 107.445140][ T5502] ? __kasan_check_byte+0x12/0x40
[ 107.445148][ T5502] ? is_bpf_text_address+0x26/0x2b0
[ 107.445170][ T5502] ? __pfx_prepare_playback_urb+0x10/0x10
[ 107.445178][ T5502] prepare_outbound_urb+0x377/0xc50
[ 107.445190][ T5502] ? check_noncircular+0xda/0x150
[ 107.445201][ T5502] ? _copy_from_iter+0xb2c/0x1630
[ 107.445214][ T5502] ? __asan_memcpy+0x40/0x70
[ 107.445226][ T5502] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 107.445235][ T5502] ? _copy_from_iter+0x11eb/0x1630
[ 107.445250][ T5502] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 107.445262][ T5502] snd_usb_endpoint_start+0x4db/0x1530
[ 107.445276][ T5502] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 107.445312][ T5502] start_endpoints+0xa1/0x280
[ 107.445322][ T5502] ? snd_usb_substream_playback_trigger+0x3ce/0x830
[ 107.445338][ T5502] snd_usb_substream_playback_trigger+0x3e0/0x830
[ 107.445354][ T5502] snd_pcm_do_start+0xb7/0x180
[ 107.445367][ T5502] snd_pcm_action+0xe7/0x240
[ 107.445376][ T5502] __snd_pcm_lib_xfer+0x1762/0x1d00
[ 107.445393][ T5502] ? __pfx_interleaved_copy+0x10/0x10
[ 107.445405][ T5502] ? __pfx_default_write_copy+0x10/0x10
[ 107.445420][ T5502] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 107.445437][ T5502] snd_pcm_oss_write3+0x1bc/0x350
[ 107.445451][ T5502] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 107.445467][ T5502] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 107.445481][ T5502] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 107.445497][ T5502] snd_pcm_oss_write+0xa2b/0xf20
[ 107.445511][ T5502] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 107.445523][ T5502] ? bpf_lsm_file_permission+0x9/0x20
[ 107.445537][ T5502] ? security_file_permission+0x75/0x290
[ 107.445552][ T5502] ? rw_verify_area+0x255/0x4d0
[ 107.445565][ T5502] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 107.445577][ T5502] vfs_write+0x27e/0xb30
[ 107.445592][ T5502] ? __pfx_vfs_write+0x10/0x10
[ 107.445603][ T5502] ? __pfx_do_futex+0x10/0x10
[ 107.445614][ T5502] ? kmem_cache_free+0x197/0x620
[ 107.445628][ T5502] ? do_sys_openat2+0x15a/0x200
[ 107.445642][ T5502] ksys_write+0x145/0x250
[ 107.445657][ T5502] ? __pfx_ksys_write+0x10/0x10
[ 107.445672][ T5502] do_syscall_64+0xec/0xf80
[ 107.445744][ T5502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.445753][ T5502] ? trace_irq_disable+0x37/0x100
[ 107.445767][ T5502] ? clear_bhb_loop+0x60/0xb0
[ 107.445777][ T5502] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.445788][ T5502] RIP: 0033:0x7f91f058f7c9
[ 107.445798][ T5502] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 107.445806][ T5502] RSP: 002b:00007ffe50afda18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 107.445818][ T5502] RAX: ffffffffffffffda RBX: 00007f91f07e5fa0 RCX: 00007f91f058f7c9
[ 107.445825][ T5502] RDX: 00000000000005ce RSI: 0000200000000600 RDI: 0000000000000004
[ 107.445830][ T5502] RBP: 00007f91f0613f91 R08: 0000000000000000 R09: 0000000000000000
[ 107.445836][ T5502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 107.445842][ T5502] R13: 00007f91f07e5fa0 R14: 00007f91f07e5fa0 R15: 0000000000000003
[ 107.445852][ T5502]
[ 107.445855][ T5502]
[ 107.613923][ T5502] Allocated by task 5502:
[ 107.615828][ T5502] kasan_save_track+0x3e/0x80
[ 107.617725][ T5502] __kasan_kmalloc+0x93/0xb0
[ 107.619401][ T5502] __kmalloc_noprof+0x41d/0x800
[ 107.621203][ T5502] snd_usb_endpoint_set_params+0x1741/0x2f10
[ 107.623536][ T5502] snd_usb_hw_params+0xb12/0x12e0
[ 107.625884][ T5502] snd_pcm_hw_params+0x89d/0x1d30
[ 107.628139][ T5502] snd_pcm_oss_change_params_locked+0x21cd/0x3f70
[ 107.631016][ T5502] snd_pcm_oss_make_ready_locked+0x7d/0x300
[ 107.633733][ T5502] snd_pcm_oss_write+0x281/0xf20
[ 107.635869][ T5502] vfs_write+0x27e/0xb30
[ 107.637829][ T5502] ksys_write+0x145/0x250
[ 107.639667][ T5502] do_syscall_64+0xec/0xf80
[ 107.641772][ T5502] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.644461][ T5502]
[ 107.645504][ T5502] The buggy address belongs to the object at ffff88801f89c200
[ 107.645504][ T5502] which belongs to the cache kmalloc-256 of size 256
[ 107.651486][ T5502] The buggy address is located 0 bytes inside of
[ 107.651486][ T5502] allocated 240-byte region [ffff88801f89c200, ffff88801f89c2f0)
[ 107.657002][ T5502]
[ 107.657866][ T5502] The buggy address belongs to the physical page:
[ 107.660046][ T5502] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f89c
[ 107.663121][ T5502] ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 107.665969][ T5502] page_type: f5(slab)
[ 107.667847][ T5502] raw: 00fff00000000000 ffff88801a441b40 ffffea00011244c0 dead00000000000b
[ 107.672171][ T5502] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 107.676184][ T5502] page dumped because: kasan: bad access detected
[ 107.679100][ T5502] page_owner tracks the page as allocated
[ 107.681384][ T5502] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5384, tgid 5384 (syz-executor), ts 99332354620, free_ts 33108972511
[ 107.689560][ T5502] post_alloc_hook+0x234/0x290
[ 107.691725][ T5502] get_page_from_freelist+0x24e0/0x2580
[ 107.694185][ T5502] __alloc_frozen_pages_noprof+0x181/0x370
[ 107.696623][ T5502] alloc_pages_mpol+0x232/0x4a0
[ 107.698758][ T5502] allocate_slab+0x86/0x3b0
[ 107.700847][ T5502] ___slab_alloc+0xe53/0x1820
[ 107.702927][ T5502] __slab_alloc+0x65/0x100
[ 107.704832][ T5502] __kmalloc_noprof+0x47d/0x800
[ 107.706841][ T5502] fib_create_info+0x171d/0x31f0
[ 107.709068][ T5502] fib_table_insert+0xca/0x1b80
[ 107.711208][ T5502] fib_magic+0x2c4/0x390
[ 107.712985][ T5502] fib_add_ifaddr+0x38d/0x5f0
[ 107.715053][ T5502] fib_netdev_event+0x382/0x490
[ 107.717108][ T5502] notifier_call_chain+0x19d/0x3a0
[ 107.719275][ T5502] __dev_notify_flags+0x18d/0x2e0
[ 107.721475][ T5502] netif_change_flags+0xe8/0x1a0
[ 107.723639][ T5502] page last free pid 4732 tgid 4732 stack trace:
[ 107.726291][ T5502] __free_frozen_pages+0xbc8/0xd30
[ 107.728448][ T5502] __put_partials+0x146/0x170
[ 107.730472][ T5502] __slab_free+0x294/0x320
[ 107.732487][ T5502] qlist_free_all+0x97/0x100
[ 107.734566][ T5502] kasan_quarantine_reduce+0x148/0x160
[ 107.736933][ T5502] __kasan_slab_alloc+0x22/0x80
[ 107.738988][ T5502] __kmalloc_noprof+0x3cf/0x800
[ 107.741067][ T5502] kernfs_fop_write_iter+0x158/0x540
[ 107.743450][ T5502] vfs_write+0x5c9/0xb30
[ 107.745319][ T5502] ksys_write+0x145/0x250
[ 107.747216][ T5502] do_syscall_64+0xec/0xf80
[ 107.749147][ T5502] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.751784][ T5502]
[ 107.752867][ T5502] Memory state around the buggy address:
[ 107.755430][ T5502] ffff88801f89c180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 107.758827][ T5502] ffff88801f89c200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 107.762320][ T5502] >ffff88801f89c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
[ 107.765808][ T5502] ^
[ 107.769016][ T5502] ffff88801f89c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 107.772594][ T5502] ffff88801f89c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 107.776015][ T5502] ==================================================================
[ 107.779538][ T5502] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 107.782741][ T5502] CPU: 0 UID: 0 PID: 5502 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 107.786597][ T5502] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 107.791056][ T5502] Call Trace:
[ 107.792577][ T5502]
[ 107.793934][ T5502] vpanic+0x1e0/0x670
[ 107.795667][ T5502] panic+0xb9/0xc0
[ 107.797282][ T5502] ? __pfx_panic+0x10/0x10
[ 107.799340][ T5502] ? copy_to_urb+0x261/0x460
[ 107.801377][ T5502] ? rcu_is_watching+0x15/0xb0
[ 107.803452][ T5502] ? copy_to_urb+0x261/0x460
[ 107.805615][ T5502] ? copy_to_urb+0x261/0x460
[ 107.807910][ T5502] check_panic_on_warn+0x89/0xb0
[ 107.810174][ T5502] ? copy_to_urb+0x261/0x460
[ 107.812198][ T5502] end_report+0x6f/0x140
[ 107.814067][ T5502] kasan_report+0x129/0x150
[ 107.816091][ T5502] ? copy_to_urb+0x261/0x460
[ 107.818305][ T5502] kasan_check_range+0x2b0/0x2c0
[ 107.820340][ T5502] ? copy_to_urb+0x261/0x460
[ 107.822324][ T5502] __asan_memcpy+0x40/0x70
[ 107.824095][ T5502] copy_to_urb+0x261/0x460
[ 107.826039][ T5502] prepare_playback_urb+0x953/0x13d0
[ 107.828232][ T5502] ? __pfx_prepare_playback_urb+0x10/0x10
[ 107.830602][ T5502] ? unwind_next_frame+0xa5/0x23d0
[ 107.832762][ T5502] ? rcu_is_watching+0x15/0xb0
[ 107.834925][ T5502] ? __kasan_check_byte+0x12/0x40
[ 107.837090][ T5502] ? is_bpf_text_address+0x26/0x2b0
[ 107.839397][ T5502] ? __pfx_prepare_playback_urb+0x10/0x10
[ 107.841806][ T5502] prepare_outbound_urb+0x377/0xc50
[ 107.844071][ T5502] ? check_noncircular+0xda/0x150
[ 107.846356][ T5502] ? _copy_from_iter+0xb2c/0x1630
[ 107.848611][ T5502] ? __asan_memcpy+0x40/0x70
[ 107.850688][ T5502] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 107.853123][ T5502] ? _copy_from_iter+0x11eb/0x1630
[ 107.855391][ T5502] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 107.858041][ T5502] snd_usb_endpoint_start+0x4db/0x1530
[ 107.860276][ T5502] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 107.862842][ T5502] start_endpoints+0xa1/0x280
[ 107.864845][ T5502] ? snd_usb_substream_playback_trigger+0x3ce/0x830
[ 107.867544][ T5502] snd_usb_substream_playback_trigger+0x3e0/0x830
[ 107.870326][ T5502] snd_pcm_do_start+0xb7/0x180
[ 107.872819][ T5502] snd_pcm_action+0xe7/0x240
[ 107.875356][ T5502] __snd_pcm_lib_xfer+0x1762/0x1d00
[ 107.878105][ T5502] ? __pfx_interleaved_copy+0x10/0x10
[ 107.880970][ T5502] ? __pfx_default_write_copy+0x10/0x10
[ 107.883468][ T5502] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 107.885816][ T5502] snd_pcm_oss_write3+0x1bc/0x350
[ 107.888006][ T5502] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 107.890492][ T5502] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 107.893193][ T5502] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 107.895960][ T5502] snd_pcm_oss_write+0xa2b/0xf20
[ 107.898096][ T5502] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 107.900416][ T5502] ? bpf_lsm_file_permission+0x9/0x20
[ 107.902761][ T5502] ? security_file_permission+0x75/0x290
[ 107.905143][ T5502] ? rw_verify_area+0x255/0x4d0
[ 107.907234][ T5502] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 107.909660][ T5502] vfs_write+0x27e/0xb30
[ 107.911722][ T5502] ? __pfx_vfs_write+0x10/0x10
[ 107.914035][ T5502] ? __pfx_do_futex+0x10/0x10
[ 107.916167][ T5502] ? kmem_cache_free+0x197/0x620
[ 107.918293][ T5502] ? do_sys_openat2+0x15a/0x200
[ 107.920447][ T5502] ksys_write+0x145/0x250
[ 107.922324][ T5502] ? __pfx_ksys_write+0x10/0x10
[ 107.924488][ T5502] do_syscall_64+0xec/0xf80
[ 107.926472][ T5502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.929086][ T5502] ? trace_irq_disable+0x37/0x100
[ 107.931397][ T5502] ? clear_bhb_loop+0x60/0xb0
[ 107.933627][ T5502] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.936180][ T5502] RIP: 0033:0x7f91f058f7c9
[ 107.938200][ T5502] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 107.946467][ T5502] RSP: 002b:00007ffe50afda18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 107.949895][ T5502] RAX: ffffffffffffffda RBX: 00007f91f07e5fa0 RCX: 00007f91f058f7c9
[ 107.953286][ T5502] RDX: 00000000000005ce RSI: 0000200000000600 RDI: 0000000000000004
[ 107.956815][ T5502] RBP: 00007f91f0613f91 R08: 0000000000000000 R09: 0000000000000000
[ 107.960358][ T5502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 107.964593][ T5502] R13: 00007f91f07e5fa0 R14: 00007f91f07e5fa0 R15: 0000000000000003
[ 107.968900][ T5502]
[ 107.971032][ T5502] Kernel Offset: disabled
[ 107.973191][ T5502] Rebooting in 86400 seconds..
VM DIAGNOSIS:
04:10:10 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90003706bb0
R8 =ffff888034e20237 R9 =1ffff110069c4046 R10=dffffc0000000000 R11=ffffffff851bb760
R12=dffffc0000000000 R13=ffffffff99900a06 R14=ffffffff99c156c0 R15=0000000000000000
RIP=ffffffff851bb7dc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055557a280500 ffffffff 00c00000
GS =0000 ffff88808d414000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffc5f9bdf68 CR3=0000000041ab1000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fffff800 Opmask01=0000000000000014 Opmask02=000000000000003f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe50afb950 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f91f0615050
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f91f061505d
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f91f0615057
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f91f061506b
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f91f06150f1
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f91f06151cf
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 2323232323232323 2323232323232323
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000336f69 6475000500060006
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000104c4a 4756420c5546470c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000