Warning: Permanently added '10.128.1.112' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs [ 31.259098][ T6554] cgroup: Unknown subsys name 'net' [ 31.352390][ T6554] cgroup: Unknown subsys name 'cpuset' [ 31.354222][ T6554] cgroup: Unknown subsys name 'rlimit' [ 31.479038][ T6554] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 36.802628][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.804242][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.805301][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.805708][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.805916][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.872947][ T6561] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 37.224694][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.224722][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.291674][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.293301][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.527280][ T6604] chnl_net:caif_netlink_parms(): no params data found [ 37.547657][ T6604] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.547702][ T6604] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.547764][ T6604] bridge_slave_0: entered allmulticast mode [ 37.548185][ T6604] bridge_slave_0: entered promiscuous mode [ 37.549052][ T6604] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.549067][ T6604] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.549105][ T6604] bridge_slave_1: entered allmulticast mode [ 37.549466][ T6604] bridge_slave_1: entered promiscuous mode [ 37.561012][ T6604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.561818][ T6604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.572134][ T6604] team0: Port device team_slave_0 added [ 37.572826][ T6604] team0: Port device team_slave_1 added [ 37.579698][ T6604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.579727][ T6604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.579739][ T6604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.580843][ T6604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.580851][ T6604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.580876][ T6604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.637450][ T6604] hsr_slave_0: entered promiscuous mode [ 37.637764][ T6604] hsr_slave_1: entered promiscuous mode [ 37.675792][ T6604] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.678400][ T6604] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.680963][ T6604] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.700834][ T6604] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.715900][ T6604] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.715955][ T6604] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.716119][ T6604] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.716142][ T6604] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.728564][ T6604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.732085][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.733888][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.738368][ T6604] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.741499][ T610] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.741542][ T610] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.743052][ T610] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.743069][ T610] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.861717][ T6604] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.897605][ T6604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.908507][ T6604] veth0_vlan: entered promiscuous mode [ 37.912084][ T6604] veth1_vlan: entered promiscuous mode [ 37.918169][ T6604] veth0_macvtap: entered promiscuous mode [ 37.919139][ T6604] veth1_macvtap: entered promiscuous mode [ 37.937620][ T6604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.941059][ T6604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.948714][ T867] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.948900][ T867] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.948929][ T867] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.948947][ T867] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.284886][ T41] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.335426][ T41] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.375692][ T41] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.425279][ T41] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:38 executed programs: 0 [ 38.640155][ T6117] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.640467][ T6117] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.640667][ T6117] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.640961][ T6117] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.641135][ T6117] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.688630][ T6658] chnl_net:caif_netlink_parms(): no params data found [ 38.707323][ T6658] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.707391][ T6658] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.707456][ T6658] bridge_slave_0: entered allmulticast mode [ 38.707854][ T6658] bridge_slave_0: entered promiscuous mode [ 38.708830][ T6658] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.708888][ T6658] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.708938][ T6658] bridge_slave_1: entered allmulticast mode [ 38.709306][ T6658] bridge_slave_1: entered promiscuous mode [ 38.719343][ T6658] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.720250][ T6658] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.727186][ T6658] team0: Port device team_slave_0 added [ 38.727867][ T6658] team0: Port device team_slave_1 added [ 38.734957][ T6658] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.734975][ T6658] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.734998][ T6658] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.735518][ T6658] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.735524][ T6658] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.735535][ T6658] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.755450][ T6658] hsr_slave_0: entered promiscuous mode [ 38.755713][ T6658] hsr_slave_1: entered promiscuous mode [ 38.755886][ T6658] debugfs: 'hsr0' already exists in 'hsr' [ 38.755935][ T6658] Cannot create hsr debugfs directory [ 40.650680][ T52] Bluetooth: hci0: command tx timeout [ 40.890848][ T41] bridge_slave_1: left allmulticast mode [ 40.890882][ T41] bridge_slave_1: left promiscuous mode [ 40.891125][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.895826][ T41] bridge_slave_0: left allmulticast mode [ 40.895854][ T41] bridge_slave_0: left promiscuous mode [ 40.895920][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.053177][ T41] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.091088][ T41] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 41.150595][ T41] bond0 (unregistering): Released all slaves [ 41.229346][ T41] hsr_slave_0: left promiscuous mode [ 41.231159][ T41] hsr_slave_1: left promiscuous mode [ 41.235463][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 41.235494][ T41] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 41.237149][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.237159][ T41] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.243338][ T41] veth1_macvtap: left promiscuous mode [ 41.244671][ T41] veth0_macvtap: left promiscuous mode [ 41.245551][ T41] veth1_vlan: left promiscuous mode [ 41.245622][ T41] veth0_vlan: left promiscuous mode [ 41.356387][ T41] team0 (unregistering): Port device team_slave_1 removed [ 41.362452][ T41] team0 (unregistering): Port device team_slave_0 removed [ 41.563237][ T6658] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 41.564578][ T6658] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 41.566649][ T6658] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 41.568844][ T6658] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 41.592650][ T6658] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.597506][ T6658] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.607306][ T867] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.607346][ T867] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.607836][ T867] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.607850][ T867] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.751261][ T6658] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.762190][ T6658] veth0_vlan: entered promiscuous mode [ 41.766257][ T6658] veth1_vlan: entered promiscuous mode [ 41.773797][ T6658] veth0_macvtap: entered promiscuous mode [ 41.774688][ T6658] veth1_macvtap: entered promiscuous mode [ 41.777404][ T6658] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.778287][ T6658] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.781462][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.781606][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.781621][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.781634][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.801982][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.802006][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.809749][ T610] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.809771][ T610] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.160106][ T6619] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 42.313399][ T6619] usb 1-1: config 0 has an invalid interface number: 230 but max is 0 [ 42.313428][ T6619] usb 1-1: config 0 has no interface number 0 [ 42.313451][ T6619] usb 1-1: config 0 interface 230 altsetting 0 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 42.313460][ T6619] usb 1-1: config 0 interface 230 altsetting 0 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 42.313474][ T6619] usb 1-1: New USB device found, idVendor=0424, idProduct=c001, bcdDevice=7f.ee [ 42.313480][ T6619] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.315543][ T6619] usb 1-1: config 0 descriptor?? [ 42.520492][ T6619] usb 1-1: USB disconnect, device number 2 [ 42.524149][ T6619] ================================================================== [ 42.524160][ T6619] BUG: KASAN: slab-use-after-free in hdm_disconnect+0xf4/0x18c [ 42.524174][ T6619] Read of size 8 at addr ffff ** replaying previous printk message ** [ 42.524174][ T6619] Read of size 8 at addr ffff0000c935d8b0 by task kworker/1:3/6619 [ 42.524182][ T6619] [ 42.524187][ T6619] CPU: 1 UID: 0 PID: 6619 Comm: kworker/1:3 Not tainted 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT [ 42.524198][ T6619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 42.524203][ T6619] Workqueue: usb_hub_wq hub_event [ 42.524214][ T6619] Call trace: [ 42.524217][ T6619] show_stack+0x2c/0x3c (C) [ 42.524225][ T6619] __dump_stack+0x30/0x40 [ 42.524231][ T6619] dump_stack_lvl+0xd8/0x12c [ 42.524236][ T6619] print_address_description+0xa8/0x238 [ 42.524243][ T6619] print_report+0x68/0x84 [ 42.524250][ T6619] kasan_report+0xb0/0x110 [ 42.524257][ T6619] __asan_report_load8_noabort+0x20/0x2c [ 42.524262][ T6619] hdm_disconnect+0xf4/0x18c [ 42.524267][ T6619] usb_unbind_interface+0x244/0x7e4 [ 42.524273][ T6619] device_release_driver_internal+0x3f8/0x68c [ 42.524281][ T6619] device_release_driver+0x28/0x38 [ 42.524287][ T6619] bus_remove_device+0x310/0x3b0 [ 42.524293][ T6619] device_del+0x47c/0x808 [ 42.524298][ T6619] usb_disable_device+0x33c/0x780 [ 42.524303][ T6619] usb_disconnect+0x284/0x82c [ 42.524309][ T6619] hub_event+0x1688/0x3c78 [ 42.524315][ T6619] process_one_work+0x7e8/0x155c [ 42.524321][ T6619] worker_thread+0x958/0xed8 [ 42.524326][ T6619] kthread+0x5fc/0x75c [ 42.524332][ T6619] ret_from_fork+0x10/0x20 [ 42.524338][ T6619] [ 42.524339][ T6619] Allocated by task 6619: [ 42.524343][ T6619] kasan_save_track+0x40/0x78 [ 42.524349][ T6619] kasan_save_alloc_info+0x44/0x54 [ 42.524353][ T6619] __kasan_kmalloc+0x9c/0xb4 [ 42.524358][ T6619] __kmalloc_cache_noprof+0x2a4/0x3fc [ 42.524364][ T6619] hdm_probe+0x9c/0x1044 [ 42.524368][ T6619] usb_probe_interface+0x5a4/0xaac [ 42.524373][ T6619] really_probe+0x3b4/0x944 [ 42.524378][ T6619] __driver_probe_device+0x180/0x2d4 [ 42.524384][ T6619] driver_probe_device+0x78/0x330 [ 42.524390][ T6619] __device_attach_driver+0x290/0x4e0 [ 42.524395][ T6619] bus_for_each_drv+0x220/0x2b4 [ 42.524400][ T6619] __device_attach+0x26c/0x388 [ 42.524406][ T6619] device_initial_probe+0x24/0x34 [ 42.524411][ T6619] bus_probe_device+0x178/0x240 [ 42.524416][ T6619] device_add+0x71c/0xa60 [ 42.524420][ T6619] usb_set_configuration+0x1640/0x1bac [ 42.524425][ T6619] usb_generic_driver_probe+0x8c/0x144 [ 42.524430][ T6619] usb_probe_device+0x1a4/0x348 [ 42.524434][ T6619] really_probe+0x3b4/0x944 [ 42.524439][ T6619] __driver_probe_device+0x180/0x2d4 [ 42.524445][ T6619] driver_probe_device+0x78/0x330 [ 42.524451][ T6619] __device_attach_driver+0x290/0x4e0 [ 42.524456][ T6619] bus_for_each_drv+0x220/0x2b4 [ 42.524461][ T6619] __device_attach+0x26c/0x388 [ 42.524467][ T6619] device_initial_probe+0x24/0x34 [ 42.524472][ T6619] bus_probe_device+0x178/0x240 [ 42.524477][ T6619] device_add+0x71c/0xa60 [ 42.524481][ T6619] usb_new_device+0x7f0/0x123c [ 42.524486][ T6619] hub_event+0x211c/0x3c78 [ 42.524491][ T6619] process_one_work+0x7e8/0x155c [ 42.524495][ T6619] worker_thread+0x958/0xed8 [ 42.524499][ T6619] kthread+0x5fc/0x75c [ 42.524504][ T6619] ret_from_fork+0x10/0x20 [ 42.524509][ T6619] [ 42.524510][ T6619] Freed by task 6619: [ 42.524513][ T6619] kasan_save_track+0x40/0x78 [ 42.524518][ T6619] kasan_save_free_info+0x58/0x70 [ 42.524522][ T6619] __kasan_slab_free+0x74/0x98 [ 42.524528][ T6619] kfree+0x17c/0x474 [ 42.524533][ T6619] release_mdev+0x20/0x30 [ 42.524537][ T6619] device_release+0x8c/0x1ac [ 42.524541][ T6619] kobject_put+0x2b0/0x438 [ 42.524547][ T6619] device_unregister+0x3c/0xcc [ 42.524552][ T6619] most_deregister_interface+0x3e0/0x42c [ 42.524558][ T6619] hdm_disconnect+0xdc/0x18c [ 42.524561][ T6619] usb_unbind_interface+0x244/0x7e4 [ 42.524566][ T6619] device_release_driver_internal+0x3f8/0x68c [ 42.524572][ T6619] device_release_driver+0x28/0x38 [ 42.524577][ T6619] bus_remove_device+0x310/0x3b0 [ 42.524582][ T6619] device_del+0x47c/0x808 [ 42.524586][ T6619] usb_disable_device+0x33c/0x780 [ 42.524590][ T6619] usb_disconnect+0x284/0x82c [ 42.524595][ T6619] hub_event+0x1688/0x3c78 [ 42.524600][ T6619] process_one_work+0x7e8/0x155c [ 42.524604][ T6619] worker_thread+0x958/0xed8 [ 42.524608][ T6619] kthread+0x5fc/0x75c [ 42.524613][ T6619] ret_from_fork+0x10/0x20 [ 42.524618][ T6619] [ 42.524619][ T6619] The buggy address belongs to the object at ffff0000c935c000 [ 42.524619][ T6619] which belongs to the cache kmalloc-8k of size 8192 [ 42.524624][ T6619] The buggy address is located 6320 bytes inside of [ 42.524624][ T6619] freed 8192-byte region [ffff0000c935c000, ffff0000c935e000) [ 42.524629][ T6619] [ 42.524631][ T6619] The buggy address belongs to the physical page: [ 42.524634][ T6619] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109358 [ 42.524640][ T6619] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.524644][ T6619] ksm flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 42.524651][ T6619] page_type: f5(slab) [ 42.524657][ T6619] raw: 05ffc00000000040 ffff0000c0002280 fffffdffc3248e00 0000000000000003 [ 42.524661][ T6619] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 42.524665][ T6619] head: 05ffc00000000040 ffff0000c0002280 fffffdffc3248e00 0000000000000003 [ 42.524669][ T6619] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 42.524673][ T6619] head: 05ffc00000000003 fffffdffc324d601 00000000ffffffff 00000000ffffffff [ 42.524677][ T6619] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 42.524680][ T6619] page dumped because: kasan: bad access detected [ 42.524682][ T6619] [ 42.524684][ T6619] Memory state around the buggy address: [ 42.524687][ T6619] ffff0000c935d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.524690][ T6619] ffff0000c935d800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.524694][ T6619] >ffff0000c935d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.524696][ T6619] ^ [ 42.524699][ T6619] ffff0000c935d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.524702][ T6619] ffff0000c935d980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.524705][ T6619] ================================================================== [ 42.527792][ T6619] Disabling lock debugging due to kernel taint [ 42.527829][ T6619] ------------[ cut here ]------------ [ 42.527834][ T6619] refcount_t: underflow; use-after-free. [ 42.527963][ T6619] WARNING: CPU: 1 PID: 6619 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 42.622679][ T6619] Modules linked in: [ 42.623257][ T6619] CPU: 1 UID: 0 PID: 6619 Comm: kworker/1:3 Tainted: G B 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT [ 42.625295][ T6619] Tainted: [B]=BAD_PAGE [ 42.625936][ T6619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 42.627616][ T6619] Workqueue: usb_hub_wq hub_event [ 42.628377][ T6619] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 42.629622][ T6619] pc : refcount_warn_saturate+0x154/0x1f8 [ 42.630557][ T6619] lr : refcount_warn_saturate+0x154/0x1f8 [ 42.631450][ T6619] sp : ffff8000a4bf7330 [ 42.632119][ T6619] x29: ffff8000a4bf7330 x28: ffff0000ccf9c0b0 x27: 1fffe0001926b800 [ 42.633283][ T6619] x26: 1fffe0001926b807 x25: dfff800000000000 x24: ffff8000926267d0 [ 42.634671][ T6619] x23: 1fffe0001926b8a2 x22: ffff0000c935c03c x21: 0000000000000000 [ 42.636028][ T6619] x20: ffff0000c935c038 x19: ffff800092df5000 x18: 1fffe000337a0688 [ 42.637340][ T6619] x17: ffff80008f7be000 x16: ffff80008b007230 x15: 0000000000000001 [ 42.638619][ T6619] x14: 1ffff0001497ed98 x13: 0000000000000000 x12: 0000000000000000 [ 42.639893][ T6619] x11: ffff70001497ed99 x10: 0000000000ff0100 x9 : 7fd18f0a19ebeb00 [ 42.641120][ T6619] x8 : 7fd18f0a19ebeb00 x7 : 0000000000000001 x6 : ffff800080563af4 [ 42.642458][ T6619] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002 [ 42.643746][ T6619] x2 : 0000000000000002 x1 : 0000000100000000 x0 : 0000000000000000 [ 42.644941][ T6619] Call trace: [ 42.645447][ T6619] refcount_warn_saturate+0x154/0x1f8 (P) [ 42.646419][ T6619] kobject_put+0x194/0x438 [ 42.647104][ T6619] put_device+0x28/0x40 [ 42.647751][ T6619] hdm_disconnect+0x174/0x18c [ 42.648377][ T6619] usb_unbind_interface+0x244/0x7e4 [ 42.649198][ T6619] device_release_driver_internal+0x3f8/0x68c [ 42.650188][ T6619] device_release_driver+0x28/0x38 [ 42.651036][ T6619] bus_remove_device+0x310/0x3b0 [ 42.651854][ T6619] device_del+0x47c/0x808 [ 42.652558][ T6619] usb_disable_device+0x33c/0x780 [ 42.653344][ T6619] usb_disconnect+0x284/0x82c [ 42.654130][ T6619] hub_event+0x1688/0x3c78 [ 42.654870][ T6619] process_one_work+0x7e8/0x155c [ 42.655688][ T6619] worker_thread+0x958/0xed8 [ 42.656381][ T6619] kthread+0x5fc/0x75c [ 42.657015][ T6619] ret_from_fork+0x10/0x20 [ 42.657739][ T6619] irq event stamp: 19109 [ 42.658414][ T6619] hardirqs last enabled at (19109): [] finish_lock_switch+0xb0/0x1c0 [ 42.659998][ T6619] hardirqs last disabled at (19108): [] __schedule+0x318/0x2864 [ 42.661444][ T6619] softirqs last enabled at (17984): [] handle_softirqs+0xaf8/0xc88 [ 42.663003][ T6619] softirqs last disabled at (17937): [] __do_softirq+0x14/0x20 [ 42.664455][ T6619] ---[ end trace 0000000000000000 ]--- [ 42.729906][ T6117] Bluetooth: hci0: command tx timeout