ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor2463700099 <...> Warning: Permanently added '10.128.0.8' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor2463700099", ["ci2-upstream-fs/syz-executor2463700099"], 0x7ffcf4cb92e0 /* 10 vars */) = 0 brk(NULL) = 0x55557dd23000 brk(0x55557dd23d80) = 0x55557dd23d80 arch_prctl(ARCH_SET_FS, 0x55557dd23400) = 0 set_tid_address(0x55557dd236d0) = 5612 set_robust_list(0x55557dd236e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor2463700099", 4096) = 44 getrandom("\xe8\x47\xbd\x54\x1d\xf8\xed\xbc", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557dd23d80 brk(0x55557dd44d80) = 0x55557dd44d80 brk(0x55557dd45000) = 0x55557dd45000 mprotect(0x7f20a3a09000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 [ 100.456791][ T5612] cgroup: Unknown subsys name 'net' umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 [ 100.764872][ T5612] cgroup: Unknown subsys name 'cpuset' umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) [ 100.844447][ T5612] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) getrandom("\xed\x3e\xc7\x78\x82\x96\x4c\x4d", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.t1HimC", 0700) = 0 chmod("./syzkaller.t1HimC", 0777) = 0 chdir("./syzkaller.t1HimC") = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5615 attached , child_tidptr=0x55557dd236d0) = 5615 [pid 5615] set_robust_list(0x55557dd236e0, 24 [pid 5612] rt_sigprocmask(SIG_SETMASK, [] [pid 5615] <... set_robust_list resumed>) = 0 [pid 5612] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5615] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5615] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5615] getppid() = 0 [pid 5615] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5615] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5615] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5615] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5615] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5615] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5615] unshare(CLONE_NEWNS) = 0 [pid 5615] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5615] unshare(CLONE_NEWIPC) = 0 [pid 5615] unshare(CLONE_NEWCGROUP) = 0 [pid 5615] unshare(CLONE_NEWUTS) = 0 [pid 5615] unshare(CLONE_SYSVSEM) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "16777216", 8) = 8 [pid 5615] close(3) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "536870912", 9) = 9 [pid 5615] close(3) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "1024", 4) = 4 [pid 5615] close(3) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "8192", 4) = 4 [pid 5615] close(3) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "1024", 4) = 4 [pid 5615] close(3) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "1024", 4) = 4 [pid 5615] close(3) = 0 [pid 5615] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5615] close(3) = 0 [pid 5615] getpid() = 1 [pid 5615] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5615] rt_sigprocmask(SIG_SETMASK, [] [pid 5619] <... set_robust_list resumed>) = 0 [pid 5619] rt_sigprocmask(SIG_SETMASK, [] [pid 5615] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5619] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5619] chdir("./0") = 0 [pid 5619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5619] setpgid(0, 0) = 0 [pid 5619] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5619] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5619] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5619] write(3, "1000", 4) = 4 [pid 5619] close(3) = 0 [pid 5619] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5619] write(1, "executing program\n", 18) = 18 executing program [pid 5619] mkdirat(AT_FDCWD, "./gadget", 0777) = 0 [pid 5619] mount(NULL, "./gadget", "gadgetfs", 0, NULL) = 0 [pid 5619] openat(AT_FDCWD, "./gadget/dummy_udc", O_RDWR|O_NONBLOCK) = 3 [pid 5619] mkdirat(AT_FDCWD, "./cgroup.cpu/test", 03567) = 0 [pid 5619] openat(AT_FDCWD, "./cgroup.cpu/test/memory.limit_in_bytes", O_RDWR|FASYNC) = 4 [pid 5619] write(4, "1", 1) = 1 [pid 5619] openat(AT_FDCWD, "./cgroup.cpu/test/cgroup.procs", O_RDWR) = 5 [pid 5619] write(5, "0", 1) = 1 [ 101.904556][ T5619] syz-executor246 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 101.904596][ T5619] CPU: 0 UID: 0 PID: 5619 Comm: syz-executor246 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 101.904618][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.904633][ T5619] Call Trace: [ 101.904640][ T5619] [ 101.904646][ T5619] dump_stack_lvl+0xe8/0x150 [ 101.904693][ T5619] dump_header+0xd3/0x4b0 [ 101.904719][ T5619] oom_kill_process+0x3ab/0x970 [ 101.904746][ T5619] out_of_memory+0x1064/0x1480 [ 101.904778][ T5619] ? __pfx_out_of_memory+0x10/0x10 [ 101.904804][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 101.904831][ T5619] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 101.904854][ T5619] ? _mutex_lock_killable+0x152/0x1d0 [ 101.904874][ T5619] ? try_charge_memcg+0xbb6/0x15b0 [ 101.904896][ T5619] try_charge_memcg+0xc75/0x15b0 [ 101.904927][ T5619] ? __pfx_try_charge_memcg+0x10/0x10 [ 101.904951][ T5619] ? percpu_ref_tryget+0x15/0x180 [ 101.904972][ T5619] ? __memcg_slab_post_alloc_hook+0x755/0xf60 [ 101.904994][ T5619] ? __memcg_slab_post_alloc_hook+0x755/0xf60 [ 101.905010][ T5619] ? __memcg_slab_post_alloc_hook+0x755/0xf60 [ 101.905028][ T5619] __memcg_slab_post_alloc_hook+0x94e/0xf60 [ 101.905059][ T5619] kmem_cache_alloc_lru_noprof+0x410/0x650 [ 101.905078][ T5619] ? alloc_inode+0xb8/0x1b0 [ 101.905092][ T5619] ? alloc_inode+0xb8/0x1b0 [ 101.905111][ T5619] alloc_inode+0xb8/0x1b0 [ 101.905128][ T5619] new_inode+0x1f/0x170 [ 101.905147][ T5619] gadgetfs_bind+0x4b4/0xae0 [ 101.905178][ T5619] ? __pfx_gadgetfs_bind+0x10/0x10 [ 101.905196][ T5619] gadget_bind_driver+0x2ca/0x9e0 [ 101.905230][ T5619] ? __pfx_gadget_bind_driver+0x10/0x10 [ 101.905255][ T5619] really_probe+0x254/0xae0 [ 101.905284][ T5619] __driver_probe_device+0x1e8/0x360 [ 101.905310][ T5619] driver_probe_device+0x4f/0x240 [ 101.905337][ T5619] __driver_attach+0x339/0x600 [ 101.905369][ T5619] bus_for_each_dev+0x23e/0x2c0 [ 101.905387][ T5619] ? __pfx___driver_attach+0x10/0x10 [ 101.905411][ T5619] ? __pfx_bus_for_each_dev+0x10/0x10 [ 101.905428][ T5619] ? rt_spin_unlock+0x157/0x200 [ 101.905449][ T5619] ? rt_spin_unlock+0x163/0x200 [ 101.905468][ T5619] bus_add_driver+0x348/0x670 [ 101.905493][ T5619] driver_register+0x23a/0x320 [ 101.905511][ T5619] usb_gadget_register_driver_owner+0xf9/0x270 [ 101.905539][ T5619] dev_config+0xe4e/0x12c0 [ 101.905563][ T5619] ? __pfx_dev_config+0x10/0x10 [ 101.905586][ T5619] ? __pfx_dev_config+0x10/0x10 [ 101.905602][ T5619] vfs_write+0x29f/0xbb0 [ 101.905630][ T5619] ? __pfx_vfs_write+0x10/0x10 [ 101.905653][ T5619] ? rt_spin_unlock+0x157/0x200 [ 101.905653][ T5619] ? rt_spin_unlock+0x157/0x200 [ 101.905674][ T5619] ? rt_spin_unlock+0x163/0x200 [ 101.905698][ T5619] ksys_write+0x156/0x270 [ 101.905721][ T5619] ? __pfx_ksys_write+0x10/0x10 [ 101.905747][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.905764][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.905781][ T5619] do_syscall_64+0x174/0x580 [ 101.905803][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.905819][ T5619] ? clear_bhb_loop+0x40/0x90 [ 101.905839][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.905855][ T5619] RIP: 0033:0x7f20a39768e9 [ 101.905878][ T5619] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 101.905890][ T5619] RSP: 002b:00007ffe1170d338 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.905907][ T5619] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f20a39768e9 [ 101.905917][ T5619] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 101.905927][ T5619] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 101.905935][ T5619] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20a39dd042 [ 101.905945][ T5619] R13: 00007ffe1170d370 R14: 00007ffe1170d3b0 R15: 0000000000000000 [ 101.905968][ T5619] [ 101.906610][ T5619] memory: usage 0kB, limit 0kB, failcnt 19 [ 101.906622][ T5619] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 101.906632][ T5619] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 101.906641][ T5619] Memory cgroup stats for /syz0/test: [ 101.906907][ T5619] cache 0 [ 101.906914][ T5619] rss 0 [ 101.906919][ T5619] shmem 0 [ 101.906924][ T5619] mapped_file 0 [ 101.906929][ T5619] dirty 0 [ 101.906933][ T5619] writeback 0 [ 101.906938][ T5619] workingset_refault_anon 0 [ 101.906944][ T5619] workingset_refault_file 0 [ 101.906950][ T5619] swap 0 [ 101.906955][ T5619] swapcached 0 [ 101.906960][ T5619] pgpgin 0 [ 101.906965][ T5619] pgpgout 0 [ 101.906969][ T5619] pgfault 0 [ 101.906974][ T5619] pgmajfault 0 [ 101.906979][ T5619] inactive_anon 0 [ 101.906984][ T5619] active_anon 0 [ 101.906990][ T5619] inactive_file 0 [ 101.906995][ T5619] active_file 0 [ 101.907000][ T5619] unevictable 0 [ 101.907005][ T5619] hierarchical_memory_limit 0 [ 101.907011][ T5619] hierarchical_memsw_limit 9223372036854771712 [ 101.907017][ T5619] total_cache 0 [ 101.907022][ T5619] total_rss 0 [ 101.907027][ T5619] total_shmem 0 [ 101.907032][ T5619] total_mapped_file 0 [ 101.907038][ T5619] total_dirty 0 [ 101.907043][ T5619] total_writeback 0 [ 101.907048][ T5619] total_workingset_refault_anon 0 [ 101.907054][ T5619] total_workingset_refault_file 0 [ 101.907060][ T5619] total_swap 0 [ 101.907065][ T5619] total_swapcached 0 [ 101.907070][ T5619] total_pgpgin 0 [ 101.907075][ T5619] total_pgpgout 0 [ 101.907080][ T5619] total_pgfault 0 [ 101.907086][ T5619] total_pgmajfault 0 [ 101.907091][ T5619] total_inactive_anon 0 [ 101.907096][ T5619] total_active_anon 0 [ 101.907102][ T5619] total_inactive_file 0 [ 101.907107][ T5619] total_active_file 0 [ 101.907112][ T5619] total_unevictable 0 [ 101.907118][ T5619] anon_cost 0 [ 101.907122][ T5619] file_cost 0 [ 101.907128][ T5619] Tasks state (memory values in pages): [ 101.907133][ T5619] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name [ 101.907158][ T5619] [ 5619] 0 5619 4360 109 15 94 0 53248 0 1000 syz-executor246 [ 101.907189][ T5619] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz-executor246,pid=5619,uid=0 [ 101.907382][ T5619] Memory cgroup out of memory: Killed process 5619 (syz-executor246) total-vm:17440kB, anon-rss:60kB, file-rss:376kB, shmem-rss:0kB, UID:0 pgtables:52kB oom_score_adj:1000 [ 102.018721][ T5619] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 102.018792][ T5619] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 102.155172][ T5619] udc dummy_udc.1: failed to start USB Gadget filesystem: -12 [ 102.155256][ T5619] gadgetfs gadget.1: probe with driver gadgetfs failed with error -12 [ 102.156636][ T5619] ================================================================== [ 102.156667][ T5619] BUG: KASAN: slab-use-after-free in gadgetfs_bind+0xd8/0xae0 [ 102.156743][ T5619] Write of size 8 at addr ffff888038c6a900 by task syz-executor246/5619 [ 102.156782][ T5619] [ 102.156814][ T5619] CPU: 0 UID: 0 PID: 5619 Comm: syz-executor246 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.156880][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.156913][ T5619] Call Trace: [ 102.156934][ T5619] [ 102.156964][ T5619] dump_stack_lvl+0xe8/0x150 [ 102.157086][ T5619] print_address_description+0x55/0x1e0 [ 102.157180][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.157236][ T5619] print_report+0x58/0x70 [ 102.157321][ T5619] kasan_report+0x117/0x150 [ 102.157396][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.157470][ T5619] gadgetfs_bind+0xd8/0xae0 [ 102.157544][ T5619] ? __pfx_gadgetfs_bind+0x10/0x10 [ 102.157601][ T5619] gadget_bind_driver+0x2ca/0x9e0 [ 102.157707][ T5619] ? __pfx_gadget_bind_driver+0x10/0x10 [ 102.157786][ T5619] really_probe+0x254/0xae0 [ 102.157882][ T5619] __driver_probe_device+0x1e8/0x360 [ 102.157966][ T5619] driver_probe_device+0x4f/0x240 [ 102.158059][ T5619] __driver_attach+0x339/0x600 [ 102.158131][ T5619] bus_for_each_dev+0x23e/0x2c0 [ 102.158195][ T5619] ? __pfx___driver_attach+0x10/0x10 [ 102.158281][ T5619] ? __pfx_bus_for_each_dev+0x10/0x10 [ 102.158344][ T5619] ? rt_spin_unlock+0x157/0x200 [ 102.158423][ T5619] ? rt_spin_unlock+0x163/0x200 [ 102.158486][ T5619] bus_add_driver+0x348/0x670 [ 102.158561][ T5619] driver_register+0x23a/0x320 [ 102.158623][ T5619] usb_gadget_register_driver_owner+0xf9/0x270 [ 102.158718][ T5619] dev_config+0xe4e/0x12c0 [ 102.158780][ T5619] ? __pfx_dev_config+0x10/0x10 [ 102.158845][ T5619] ? __pfx_dev_config+0x10/0x10 [ 102.158907][ T5619] vfs_write+0x29f/0xbb0 [ 102.158975][ T5619] ? __pfx_vfs_write+0x10/0x10 [ 102.159048][ T5619] ? rt_spin_unlock+0x157/0x200 [ 102.159138][ T5619] ? rt_spin_unlock+0x163/0x200 [ 102.159219][ T5619] ksys_write+0x156/0x270 [ 102.159304][ T5619] ? __pfx_ksys_write+0x10/0x10 [ 102.159385][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.159442][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.159503][ T5619] do_syscall_64+0x174/0x580 [ 102.159579][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.159641][ T5619] ? clear_bhb_loop+0x40/0x90 [ 102.159705][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.159762][ T5619] RIP: 0033:0x7f20a39768e9 [ 102.159808][ T5619] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 102.159857][ T5619] RSP: 002b:00007ffe1170d338 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.159920][ T5619] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f20a39768e9 [ 102.159962][ T5619] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 102.159996][ T5619] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.160029][ T5619] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20a39dd042 [ 102.160068][ T5619] R13: 00007ffe1170d370 R14: 00007ffe1170d3b0 R15: 0000000000000000 [ 102.160132][ T5619] [ 102.160146][ T5619] [ 102.160164][ T5619] Allocated by task 5615: [ 102.160188][ T5619] kasan_save_track+0x3e/0x80 [ 102.160251][ T5619] __kasan_kmalloc+0x93/0xb0 [ 102.160305][ T5619] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 102.160361][ T5619] gadgetfs_fill_super+0x27b/0x7a0 [ 102.160413][ T5619] get_tree_single+0xc0/0x150 [ 102.160492][ T5619] vfs_get_tree+0x92/0x2a0 [ 102.160584][ T5619] do_new_mount+0x319/0xdc0 [ 102.160636][ T5619] __se_sys_mount+0x31d/0x420 [ 102.160689][ T5619] do_syscall_64+0x174/0x580 [ 102.160758][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.160811][ T5619] [ 102.160822][ T5619] Freed by task 5619: [ 102.160844][ T5619] kasan_save_track+0x3e/0x80 [ 102.160897][ T5619] kasan_save_free_info+0x40/0x50 [ 102.160972][ T5619] __kasan_slab_free+0x5c/0x80 [ 102.161024][ T5619] kfree+0x1c5/0x6c0 [ 102.161069][ T5619] gadgetfs_bind+0x942/0xae0 [ 102.161116][ T5619] gadget_bind_driver+0x2ca/0x9e0 [ 102.161199][ T5619] really_probe+0x254/0xae0 [ 102.161285][ T5619] __driver_probe_device+0x1e8/0x360 [ 102.161361][ T5619] driver_probe_device+0x4f/0x240 [ 102.161436][ T5619] __driver_attach+0x339/0x600 [ 102.161512][ T5619] bus_for_each_dev+0x23e/0x2c0 [ 102.161565][ T5619] bus_add_driver+0x348/0x670 [ 102.161620][ T5619] driver_register+0x23a/0x320 [ 102.161665][ T5619] usb_gadget_register_driver_owner+0xf9/0x270 [ 102.161743][ T5619] dev_config+0xe4e/0x12c0 [ 102.161790][ T5619] vfs_write+0x29f/0xbb0 [ 102.161860][ T5619] ksys_write+0x156/0x270 [ 102.161936][ T5619] do_syscall_64+0x174/0x580 [ 102.162016][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.162069][ T5619] [ 102.162080][ T5619] The buggy address belongs to the object at ffff888038c6a800 [ 102.162080][ T5619] which belongs to the cache kmalloc-1k of size 1024 [ 102.162125][ T5619] The buggy address is located 256 bytes inside of [ 102.162125][ T5619] freed 1024-byte region [ffff888038c6a800, ffff888038c6ac00) [ 102.162181][ T5619] [ 102.162200][ T5619] The buggy address belongs to the physical page: [ 102.162236][ T5619] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888038c6d000 pfn:0x38c68 [ 102.162297][ T5619] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 102.162341][ T5619] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 102.162385][ T5619] page_type: f5(slab) [ 102.162439][ T5619] raw: 0080000000000240 ffff88813ffb2dc0 ffff88813ffb1b88 ffff88813ffb1b88 [ 102.162492][ T5619] raw: ffff888038c6d000 000000080010000a 00000000f5000000 0000000000000000 [ 102.162546][ T5619] head: 0080000000000240 ffff88813ffb2dc0 ffff88813ffb1b88 ffff88813ffb1b88 [ 102.162599][ T5619] head: ffff888038c6d000 000000080010000a 00000000f5000000 0000000000000000 [ 102.162644][ T5619] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 102.162694][ T5619] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 102.162718][ T5619] page dumped because: kasan: bad access detected [ 102.162763][ T5619] page_owner tracks the page as allocated [ 102.162784][ T5619] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5615, tgid 5615 (syz-executor246), ts 101449671750, free_ts 101302084021 [ 102.162838][ T5619] post_alloc_hook+0x1f9/0x250 [ 102.162856][ T5619] get_page_from_freelist+0x262a/0x26a0 [ 102.162902][ T5619] __alloc_frozen_pages_noprof+0x18d/0x380 [ 102.162966][ T5619] allocate_slab+0x79/0x5e0 [ 102.163039][ T5619] refill_objects+0x2d8/0x350 [ 102.163113][ T5619] __pcs_replace_empty_main+0x330/0x690 [ 102.163178][ T5619] __kmalloc_noprof+0x544/0x780 [ 102.163228][ T5619] tomoyo_init_log+0x1aaf/0x1fa0 [ 102.163312][ T5619] tomoyo_supervisor+0x35f/0x1560 [ 102.163400][ T5619] tomoyo_path2_perm+0x567/0x760 [ 102.163461][ T5619] security_sb_pivotroot+0xb6/0x270 [ 102.163537][ T5619] path_pivot_root+0x135/0xd90 [ 102.163594][ T5619] __x64_sys_pivot_root+0x15d/0x1d0 [ 102.163656][ T5619] do_syscall_64+0x174/0x580 [ 102.163723][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.163782][ T5619] page last free pid 2 tgid 2 stack trace: [ 102.163812][ T5619] __free_frozen_pages+0x10e7/0x11c0 [ 102.163867][ T5619] __slab_free+0x252/0x2a0 [ 102.163922][ T5619] qlist_free_all+0x99/0x100 [ 102.163967][ T5619] kasan_quarantine_reduce+0x148/0x160 [ 102.164019][ T5619] __kasan_slab_alloc+0x22/0x80 [ 102.164066][ T5619] kmem_cache_alloc_node_noprof+0x3eb/0x670 [ 102.164121][ T5619] dup_task_struct+0x52/0x8f0 [ 102.164185][ T5619] copy_process+0x820/0x4390 [ 102.164250][ T5619] kernel_clone+0x2d2/0x8d0 [ 102.164316][ T5619] kernel_thread+0x13f/0x1b0 [ 102.164388][ T5619] kthreadd+0x4ec/0x6e0 [ 102.164455][ T5619] ret_from_fork+0x514/0xb70 [ 102.164539][ T5619] ret_from_fork_asm+0x1a/0x30 [ 102.164585][ T5619] [ 102.164604][ T5619] Memory state around the buggy address: [ 102.164630][ T5619] ffff888038c6a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.164642][ T5619] ffff888038c6a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.164678][ T5619] >ffff888038c6a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.164711][ T5619] ^ [ 102.164742][ T5619] ffff888038c6a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.164783][ T5619] ffff888038c6aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.164820][ T5619] ================================================================== [ 102.168988][ T5619] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.169043][ T5619] CPU: 0 UID: 0 PID: 5619 Comm: syz-executor246 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.169116][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.169158][ T5619] Call Trace: [ 102.169180][ T5619] [ 102.169203][ T5619] vpanic+0x56c/0xa60 [ 102.169268][ T5619] ? rcu_is_watching+0x15/0xb0 [ 102.169344][ T5619] ? __pfx_vpanic+0x10/0x10 [ 102.169409][ T5619] panic+0xc5/0xd0 [ 102.169462][ T5619] ? __pfx_panic+0x10/0x10 [ 102.169545][ T5619] ? preempt_schedule_thunk+0x16/0x40 [ 102.169637][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.169701][ T5619] ? preempt_schedule_thunk+0x16/0x40 [ 102.169762][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.169824][ T5619] check_panic_on_warn+0x89/0xb0 [ 102.169880][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.169980][ T5619] end_report+0x73/0x170 [ 102.170045][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.170101][ T5619] kasan_report+0x128/0x150 [ 102.170147][ T5619] ? gadgetfs_bind+0xd8/0xae0 [ 102.170221][ T5619] gadgetfs_bind+0xd8/0xae0 [ 102.170307][ T5619] ? __pfx_gadgetfs_bind+0x10/0x10 [ 102.170369][ T5619] gadget_bind_driver+0x2ca/0x9e0 [ 102.170474][ T5619] ? __pfx_gadget_bind_driver+0x10/0x10 [ 102.170560][ T5619] really_probe+0x254/0xae0 [ 102.170650][ T5619] __driver_probe_device+0x1e8/0x360 [ 102.170737][ T5619] driver_probe_device+0x4f/0x240 [ 102.170823][ T5619] __driver_attach+0x339/0x600 [ 102.170922][ T5619] bus_for_each_dev+0x23e/0x2c0 [ 102.171000][ T5619] ? __pfx___driver_attach+0x10/0x10 [ 102.171085][ T5619] ? __pfx_bus_for_each_dev+0x10/0x10 [ 102.171149][ T5619] ? rt_spin_unlock+0x157/0x200 [ 102.171215][ T5619] ? rt_spin_unlock+0x163/0x200 [ 102.171288][ T5619] bus_add_driver+0x348/0x670 [ 102.171356][ T5619] driver_register+0x23a/0x320 [ 102.171419][ T5619] usb_gadget_register_driver_owner+0xf9/0x270 [ 102.171507][ T5619] dev_config+0xe4e/0x12c0 [ 102.171581][ T5619] ? __pfx_dev_config+0x10/0x10 [ 102.171648][ T5619] ? __pfx_dev_config+0x10/0x10 [ 102.171703][ T5619] vfs_write+0x29f/0xbb0 [ 102.171781][ T5619] ? __pfx_vfs_write+0x10/0x10 [ 102.171855][ T5619] ? rt_spin_unlock+0x157/0x200 [ 102.171920][ T5619] ? rt_spin_unlock+0x163/0x200 [ 102.171987][ T5619] ksys_write+0x156/0x270 [ 102.172071][ T5619] ? __pfx_ksys_write+0x10/0x10 [ 102.172166][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.172222][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.172293][ T5619] do_syscall_64+0x174/0x580 [ 102.172376][ T5619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.172438][ T5619] ? clear_bhb_loop+0x40/0x90 [ 102.172495][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.172550][ T5619] RIP: 0033:0x7f20a39768e9 [ 102.172602][ T5619] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 102.172653][ T5619] RSP: 002b:00007ffe1170d338 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.172709][ T5619] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f20a39768e9 [ 102.172745][ T5619] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 102.172766][ T5619] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.172805][ T5619] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20a39dd042 [ 102.172825][ T5619] R13: 00007ffe1170d370 R14: 00007ffe1170d3b0 R15: 0000000000000000 [ 102.172848][ T5619] [ 102.173444][ T5619] Kernel Offset: disabled